Drift hacker moves $61M in ETH to Tornado Cash

A wallet linked to the April hack of Solana-based exchange Drift deposited about 25,700 ETH, worth roughly $61 million, into the Tornado Cash mixer over two hours on Tuesday, Oct. 20, after two months of silence. Blockchain tracker Lookonchain flagged the transfers, and Arkham data shows the exploiter's addresses still hold about 81,454 ETH, roughly $194 million, Cointelegraph reports.

What we know

• The hack: Drift lost about $295 million on April 1. DefiLlama ranks it as the third-largest crypto hack of 2026, behind Bitget's wallet breach and the Liquid Network exploit.
• The suspects: in June, Drift said a forensic investigation by Mandiant attributed the attack to UNC6862, a North Korean threat group.
• The mixer: Tornado Cash pools deposits from many addresses, so funds that leave it are much harder to trace back to the hack.
• The victims: since Oct. 1, users have been able to claim and redeem DFX recovery tokens, a claim on a recovery pool that held about $3.1 million at launch and is topped up with exchange revenue and any recovered funds.

Our take

The timing is the familiar pattern. North Korea-linked groups tend to wait out the first wave of attention, then launder in large batches once fewer people are watching. Pushing tens of millions of dollars through a mixer in a single afternoon suggests the attackers are not worried about the funds being frozen.

For Drift users, the gap is stark: a recovery pool that started near $3 million against losses of $295 million. Every dollar that disappears through Tornado Cash is a dollar that will not flow back into that pool. Exchange blacklists and freezes can still catch funds when they surface at a centralized platform, but that window gets narrower with every hop.

The wider lesson is the one from the roughly $1.2 billion lost to hacks in Q3: when a protocol is drained, users should assume most of the money is gone and treat any recovery as a bonus, not a plan. That applies to DEXs as much as to centralized venues, a trade-off covered in our CEX vs DEX guide.