Drift Exploiter Sends $61M in ETH to Tornado Cash and Still Holds About $194M: What It Means for Drift Users

What happened on October 20

Lookonchain flagged that a wallet tied to the Drift exploit became active again after about two months and sent ETH to Tornado Cash over a two-hour window. Cointelegraph reported the total at about 25,700 ETH, roughly $61 million. Other outlets published smaller running totals while the deposits were still coming in: The Defiant's headline cited $54.8 million, and other crypto news sites cited figures around $61.6 million. The spread is a timing effect, not a disagreement about what happened, so use the final figure from the on-chain trackers rather than any single early headline.

Arkham's data, cited by Cointelegraph, puts the exploiter's remaining balance at about 81,454 ETH, or roughly $194 million at the time of the report. Crypto mixers pool deposits from many addresses and make it harder to follow the money, which is why a deposit like this is read as a step toward cashing out, not as a neutral transfer.

The background: how Drift was hacked

Drift is a Solana-based decentralized exchange for perpetual futures. On April 1, 2026 it was drained of roughly $295 million according to Cointelegraph; early coverage, including a BitPinas write-up of Drift's preliminary findings, used a figure of about $285 million. The difference comes from when and how the loss was counted.

The key detail is that it was not a smart-contract bug. Drift's preliminary findings, as summarized by BitPinas, describe the breach as the end of a six-month social engineering operation by a well-resourced group. Drift froze the remaining protocol functions, removed the compromised wallets from its multisig, flagged the attacker's addresses with exchanges and bridge operators, and brought in Mandiant for a full forensic investigation. In June, Drift said that investigation attributed the attack to UNC6862, a North Korean threat group, according to Cointelegraph.

DefiLlama ranks the Drift exploit as the third-largest crypto hack of 2026. Cointelegraph lists two others in the same year: the $387 million Bitget hack and the $320 million Liquid Network exploit.

What Drift users can claim today

Drift opened claims and redemptions for DFX recovery tokens on October 1. The tokens give affected users a claim on a recovery pool. At launch that pool held about $3.1 million, and it receives exchange revenue and any funds that are recovered. According to Drift's own October 1 notice, one DFX is issued per verified USDT lost, the total supply is fixed at 299,500,810.998 DFX, and the pool is topped up daily from the protocol's net revenue and any recovered funds. Drift also lists up to 127.5 million USDT committed by Tether and up to 20 million USDT from strategic partners to support relaunch and recovery. Set the roughly $3.1 million in the pool today against about 299.5 million DFX outstanding and the size of the gap is clear: the pool is a small starting point, not a refund.

Funds that enter Tornado Cash are far less likely to be frozen, because the usual tools, such as exchange blacklists and stablecoin issuer freezes, work on identifiable addresses. This is an inference from how mixers work, not a statement from Drift, and Drift has not said the October 20 deposits change its recovery plans.

What this means for you

The Drift attack started with people, not code, so the defensive habits are about people too. Treat unsolicited "recovery service" offers as scams by default, because victims of a famous hack are a standard target. Do not open code repositories or install test apps that strangers send you, keep large balances on a hardware wallet, and use a separate wallet for connecting to new protocols.

If you trade perpetuals and want to compare venues, the liquidation and funding pages show where leverage is building across exchanges: see live liquidations and the funding-rate board. For on-chain perps, Hyperliquid is the largest venue; new users can sign up with code NEXU888 via the Hyperliquid profile.

Quick answers

How much did the exploiter send to Tornado Cash? About 25,700 ETH, roughly $61 million, over two hours on October 20, according to Lookonchain via Cointelegraph. Early headlines showed lower running totals.

How much does the exploiter still hold? About 81,454 ETH, roughly $194 million, according to Arkham as cited by Cointelegraph.

How big was the original Drift hack? About $295 million per Cointelegraph, and about $285 million in early coverage of Drift's preliminary findings. Both refer to the April 1, 2026 exploit.

Who did it? Drift said in June that a Mandiant investigation attributed it to UNC6862, a North Korean group.

Can Drift users get their money back? DFX recovery tokens give a claim on a pool that held about $3.1 million at launch on October 1 and grows with revenue and any recovered funds. It is not a full refund.

Will this move the ETH price? Depositing into a mixer is not selling on an exchange, so it is not a direct sell order. Any later sale would be a separate event.