Drift Hacker Sends $109M of Ether to Tornado Cash in Two Days: What DeFi Users and Drift Claimants Should Check

What happened this week

On Tuesday 20 October, Decrypt reported that wallets linked to the Drift exploit sent 25,700 ETH, worth about $61.56 million, into Tornado Cash over roughly two hours. The addresses had been quiet for about two months. Arkham Intelligence data showed the deposits landing in batches of 100 ETH (about $237,800 each) plus smaller 10 ETH chunks, sizes that match the mixer's fixed deposit pools. Those pools let someone withdraw later from fresh addresses and break the public link between sender and receiver.

On Wednesday 21 October, Cointelegraph reported another 18,800 ETH, about $46 million, going to the mixer from an exploiter-linked wallet, taking the two-day total to 44,510 ETH, or $109 million. After Wednesday's transfers, Cointelegraph says Arkham shows the labelled wallets holding 56,569 ETH, roughly $138 million. Decrypt's Tuesday snapshot, taken before Wednesday's transfer, had put the remaining balance at 81,454 ETH, about $198 million, across 71 tracked addresses. The two figures are from different moments and different counts, so treat them as a range, not a precise balance.

It was not the first burst. Decrypt notes an earlier round on 23 and 24 July, when an address labelled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, to the same mixer.

Background on the Drift hack

The exploit hit Drift's vaults on Solana on 1 April. According to Decrypt, the attacker gained admin powers, introduced a fake token and used it to borrow out real liquidity. Drift's own asset breakdown puts the haul at about $295.7 million, led by $159.3 million in JLP (the Jupiter Liquidity Provider token) and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum. DefiLlama ranks it as this year's third-largest crypto hack, per Cointelegraph.

Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person and deposited $1 million of its own money to build trust. In June, Drift said the forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

What it means for Drift claimants

Drift's relaunched exchange now runs as Velocity. On 1 October it opened claims for its DFX recovery token, issuing one token for every USDT of verified loss, about 299.5 million tokens in total. The recovery pool held about 3.1 million USDT at launch, so early redemptions paid roughly 0.0104 USDT per token, about a penny on the dollar. The pool receives a daily cut of between 60% and 90% of Velocity's net protocol revenue, scaling up as daily revenue grows, and Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Funds recovered through freezes, the bounty or law enforcement also go into the pool.

Put those numbers side by side: a pool of about $3.1 million against nearly $300 million of verified loss means the early payout is small, and the outcome depends on Velocity's future revenue and on Tether's commitment, not on the stolen ETH coming back. Drift's own claims page adds that the DFX supply is fixed at 299,500,810.998 tokens with none to be minted later, that strategic partners have committed up to a further 20 million USDT, and that the claim window closes at 00:00 UTC on 1 January 2028, after which unclaimed DFX is burned. Cointelegraph adds that the recovery pool receives exchange revenue and recovered funds, which matches Decrypt's description.

What to check in your own wallets

1. Measure concentration. Add up what you hold in each DeFi protocol and bridge. If one protocol holds more than you could afford to lose, move part of it out.
2. Revoke old approvals. Token approvals you granted months ago can stay active. A revoke tool for your chain takes a minute and removes standing permissions.
3. Check who can upgrade or pause the contracts you use. The Drift attacker gained admin powers. A protocol where a small group can change critical settings carries a different risk from one with delayed, publicly visible governance.
4. Be wary of "recovery" offers. After any large hack, impersonators message victims and claim they can retrieve funds for a fee. Use only the claim process published by the protocol itself.
5. Know where your funds are. Funds held on a centralized exchange and funds held in a DeFi contract fail in different ways. Check the exchange profiles to see what each venue publishes about custody and withdrawals, and look at Drift's profile for what we list about the relaunch.

How to act on this

If this story makes you want less single-protocol exposure, the sensible move is to spread positions, not to leave DeFi in a panic. Perpetual-futures traders who prefer on-chain venues can look at the largest one, Hyperliquid: sign up with code NEXU888 through the Hyperliquid page and compare it with centralized options in our exchange directory. Check the live liquidations before sizing any leveraged trade.

What we could not verify

We could not independently confirm the on-chain transfers: the figures are Arkham and Onchain Lens data as reported by Decrypt and Cointelegraph. The two outlets give different remaining balances because they were written on different days, and we have not reconciled them. We also did not find a Drift statement on this week's mixer deposits.

Quick answers

How much ETH did the Drift exploiter send to Tornado Cash? 44,510 ETH, about $109 million, over Tuesday and Wednesday, per Cointelegraph.

How much was stolen from Drift? Drift's own breakdown puts the April hack at about $295.7 million; Decrypt and Cointelegraph round it to $295 million.

Who was behind the Drift hack? Drift said in June that Mandiant attributed it to UNC6862, a North Korean threat group.

Can Drift users get their money back? Partly, over time. Claims opened on 1 October through the DFX recovery token, but early redemptions paid about a penny on the dollar.

Is Tornado Cash use a sign the funds are gone? It makes tracing harder, because deposits are fixed-size and withdrawals come from fresh addresses, but it does not by itself prove the money cannot be recovered.