Drift Protocol Hacker Sends $61 Million in Ether to Tornado…

Blockchain analytics platform Lookonchain identified the transfers after roughly two months of inactivity, reporting that the deposits occurred over a two-hour period. The tracker estimated that wallets associated with the attacker still held approximately 81,864 ETH, valued at $195 million, following the transactions.

The movement represents another attempt to obscure funds stolen during the April 1 attack on the Solana-based perpetual futures exchange. It comes less than three weeks after Drift opened claims and redemptions for DFX recovery tokens, which give affected users access to a pool funded by exchange revenue and recovered assets.

What Does the $61.6 Million Transfer Reveal?

The latest transfers indicate renewed activity involving funds attributed to the Drift attacker. Tornado Cash allows users to deposit cryptocurrency into privacy-preserving contracts and subsequently withdraw it without a direct publicly visible connection between the depositing and receiving addresses.

Sending ETH through the service complicates blockchain tracing, although it does not establish that the cryptocurrency has been sold, converted into fiat currency or permanently removed from investigators’ reach.

The October movement is not the first instance of Drift-related assets entering the mixer. As FinanceFeeds reported in July, another wallet associated with the exploit transferred approximately 23,095 ETH, then worth $44.4 million, to Tornado Cash.

Those earlier transactions followed a prolonged period of inactivity after the initial attack. The repeated use of the mixing service suggests that obscuring the transaction trail remains an important part of the suspected attacker’s fund movements.

However, transfers into privacy protocols do not necessarily eliminate investigators’ ability to identify associated wallets. Transaction timing, wallet clustering, exchange interactions and subsequent asset movements can provide additional evidence even when direct tracing becomes more difficult.

Investor Takeaway

How Was the Drift Exploit Linked to North Korea?

The April 1 attack resulted in approximately $295 million in losses after attackers compromised administrative controls governing Drift’s Solana-based trading infrastructure.

Rather than exploiting a conventional smart contract vulnerability, the operation involved compromised transaction authorization and Solana durable nonce functionality, allowing previously approved transactions to be executed at a later time.

FinanceFeeds previously examined the governance compromise and controversy surrounding unfrozen USDC transfers following the attack.

In its June recovery update, Drift said a forensic investigation conducted by Google’s Mandiant attributed the incident to UNC6862, a North Korean threat group associated with other state-sponsored cryptocurrency attacks.

The attribution is based on forensic evidence and similarities in operational techniques, rather than a publicly established criminal conviction. The subsequent movement of assets through Tornado Cash is consistent with attempts to conceal stolen cryptocurrency, but does not independently establish the identity of the individual controlling each wallet.

How Does the Transfer Affect Drift’s $295 Million Recovery Plan?

The latest activity matters because Drift’s compensation system depends partly on recovering assets from wallets controlled by the attacker.

On October 1, Drift opened claims for DFX tokens, allocating one token for every USDT of verified user losses. The recovery system has a fixed total supply of approximately 299.5 million DFX.

At launch, the recovery pool contained approximately 3.1 million USDT, giving each DFX an initial redemption value of roughly 0.0104 USDT, equivalent to just over one cent for every dollar of verified losses.

As FinanceFeeds explained when DFX redemptions opened, affected users can redeem their tokens immediately, sell them on secondary markets or retain them for potential future recovery-pool distributions.

Drift previously disclosed that approximately $9.2 million in stolen assets had been frozen, although returning those funds requires additional legal and law-enforcement procedures. Frozen assets therefore cannot automatically be counted as available compensation.

The recovery framework also includes up to $127.5 million in support commitments from Tether and up to $20 million from other partners. Those commitments encompass different forms of support and should not be treated as cash already deposited into the redemption pool.

Investor Takeaway

What Should DFX Holders Watch Next?

Drift’s rebuilt trading platform, Velocity, is designed to generate recurring contributions to the recovery pool. Depending on daily net protocol revenue, between 60% and 90% of the applicable revenue bands will be allocated to compensation.

Future recovery amounts therefore depend on the exchange’s trading activity, actual partner funding and any stolen assets returned through investigations or enforcement actions.

DFX holders face an additional decision. Redeeming tokens permanently burns them and forfeits participation in subsequent recovery-pool increases. Retaining tokens preserves that potential claim, but does not guarantee full reimbursement.

The claims window remains open until January 1, 2028, when unclaimed DFX will be burned under the published recovery rules.

The next measurable developments will be changes in the recovery-pool balance, confirmed asset returns, additional transfers from attacker-linked wallets and Velocity’s ability to sustain contributions from operating revenue.

Investor Takeaway