TL;DR
The Drift Protocol exploiter transferred approximately $61 million in Ethereum to Tornado Cash after two months of inactivity.
Addresses linked to the hacker still hold around 81,454 ETH, worth approximately $194 million.
The attack on Drift Protocol resulted in $295 million in losses and was attributed to a North Korean hacking group following an investigation by Mandiant.
The hacker responsible for the Drift Protocol exploit transferred approximately $61 million in Ethereum (ETH) to Tornado Cash , a protocol that obscures transaction trails by mixing cryptocurrencies.
According to blockchain analytics platform Lookonchain, the wallet linked to the attack deposited 25,700 ETH into Tornado Cash over a two-hour period , following approximately two months of inactivity.
Data from Arkham indicates that addresses associated with the attacker still hold 81,454 ETH, worth around $194 million .
Tornado Cash pools funds from different addresses, making it more difficult to identify their origin and trace subsequent transactions.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.
Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M). https://t.co/FRtFrS7rew pic.twitter.com/9ISUIlkHvT
— Lookonchain (@lookonchain) October 20, 2026
The Hack Was Attributed to a North Korean Group
Drift Protocol is a decentralized exchange built on Solana. The platform suffered an attack on April 1 that resulted in approximately $295 million in losses .
In June, the project reported that a forensic investigation conducted by cybersecurity firm Mandiant had attributed the incident to UNC6862, a threat group linked to North Korea . The attack ranks among the largest cryptocurrency thefts recorded in 2026.
According to DefiLlama, the Drift hack ranks third by total losses , behind the Bitget hack, valued at $387 million , and the Liquid Network exploit, which resulted in $320 million in losses.
Drift Moves Forward With Compensation for Affected Users
On October 1, Drift Protocol opened claims and redemptions for DFX, the tokens created for its recovery program .
These assets give affected users claims on a fund intended to compensate them for part of the losses suffered during the attack. At launch, the recovery fund held approximately $3.1 million .
The mechanism also provides for revenue generated by the exchange and any stolen funds the project manages to recover to be added to the fund.
