Drift Exploit Wallets Move $61.56 Million in Ethereum to Tornado Cash

Wallets tied to the April 1 Drift Protocol exploit deposited 25,700 Ethereum, worth approximately $61.56 million, into the crypto mixer Tornado Cash over roughly two hours on Tuesday. The addresses had been inactive for about two months before the sudden burst of transfers.

Transfer data from Arkham Intelligence shows the deposits arriving in batches of 100 ETH, about $237,800 each, along with smaller 10 ETH increments. Those amounts match the mixer’s fixed deposit pools, which allow users to withdraw funds later from fresh addresses and sever the public on-chain link between sender and receiver.

Arkham’s entity page, which tracks 71 addresses linked to the attacker, still shows 81,454 ETH sitting in those wallets after Tuesday’s deposits, worth roughly $198.58 million at current prices. Besides that Ether stash, the wallets hold around $561,600 in other coins, including USDT, USDC, Solana, and USDY.

Tuesday’s deposits follow an initial round on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.

The April 1 exploit struck Drift’s vaults on Solana after the attacker gained administrative powers, introduced a counterfeit token, and used it to borrow out real liquidity. Drift’s own asset breakdown puts the total haul at $295.7 million, led by $159.3 million in JLP—the Jupiter Liquidity Provider token—and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum.

Arkham’s portfolio view still lists exactly one Fartcoin in the exploiter’s holdings, worth about 15 cents—a long way from the $4.1 million in Fartcoin that Drift says was taken in April.

Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person, and deposited $1 million of its own money to build trust. In June, Drift said forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

Drift, whose relaunched exchange now operates as Velocity, opened claims for its DFX recovery token on October 1, issuing one token for every USDT of verified loss, about 299.5 million in total. The recovery pool held about 3.1 million USDT at launch, so early redemptions paid roughly 0.0104 USDT per token, or about a penny on the dollar. The pool receives a daily cut of between 60% and 90% of Velocity’s net protocol revenue, scaling up as daily revenue grows, and Tether has committed up to $127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, bounties, or law enforcement also go into the pool.

Source link