Drift Protocol exploiter moves 44,510 ETH to Tornado Cash over two days after six-month dormancy
Wallets linked to the April Drift exploit sent 44,510 ETH worth $109 million to Tornado Cash on October 20-21, retaining approximately 56,569 ETH.
Why it matters
The transfers represent nearly 37% of the stolen funds moved through a sanctioned mixer, complicating recovery efforts. The renewed activity occurs while Drift's recovery pool holds only a fraction of user losses, and the exploiter retains over $138 million in ETH.
Where the sources disagree
October 20 ETH amount sent to Tornado Cash
$285 million
Crypto.News
$387 million
Cointelegraph
Sources report different ETH amounts for the October 20 transfers: Lookonchain reports 25,700 ETH, Onchain Lens reports 13,400 ETH, Salus reports 19,600 ETH, and CryptoSlate reports 25,710 ETH.
October 20 USD value of transfers
$32 million
Crypto.News
$61.56 million
Crypto News (CryptoNews.net)
Reported USD values for October 20 transfers range from $32 million to $63.1 million across different analytics sources.
Remaining exploiter ETH holdings after October transfers
81,864 ETH
Crypto.News, CryptoSlate
81,454 ETH
Cointelegraph, Decrypt
56,569 ETH
Cointelegraph, Crypto.News
Sources report different remaining balances: Lookonchain reports 81,864 ETH, Arkham reports 81,454 ETH before October 21, and Cointelegraph/Arkham report 56,569 ETH after October 21.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (linked)
$285 million
Crypto.News
$138 million
Cointelegraph
Crypto.News reports $285 million, Cointelegraph reports $138 million (52% apart).
reported value (cash tornado)
$61.56 million
Crypto.News
$46 million
Cointelegraph
Crypto.News reports $61.56 million, Cointelegraph reports $46 million (25% apart).
reported value
13,400 ETH
Crypto.News
25,700 ETH
Cointelegraph
Crypto.News reports 13,400 ETH, Cointelegraph reports 25,700 ETH (48% apart).
amount taken (sent)
$61 million
Cointelegraph
$44.4 million
Decrypt
Cointelegraph reports $61 million, Decrypt reports $44.4 million (27% apart).
reported value
25,700 ETH
Cointelegraph
18,800 ETH
Crypto.News
Cointelegraph reports 25,700 ETH, Crypto.News reports 18,800 ETH (27% apart).
reported value
$194 million
Cointelegraph
$109 million
Crypto.News
Cointelegraph reports $194 million, Crypto.News reports $109 million (44% apart).
amount taken
$387 million
Cointelegraph
$295 million
Decrypt
Cointelegraph reports $387 million, Decrypt reports $295 million (24% apart).
amount taken
$387 million
Cointelegraph
$280 million
CryptoSlate
Cointelegraph reports $387 million, CryptoSlate reports $280 million (28% apart).
amount taken
$387 million
Cointelegraph
$295 million
Crypto.News
Cointelegraph reports $387 million, Crypto.News reports $295 million (24% apart).
amount taken
$295 million
Decrypt
$138 million
Cointelegraph
Decrypt reports $295 million, Cointelegraph reports $138 million (53% apart).
amount taken (drift protocol)
$295 million
Decrypt
$109 million
Bitcoin Insider
Decrypt reports $295 million, Bitcoin Insider reports $109 million (63% apart).
reported flows (deposits)
$198.58 million
Decrypt
$138 million
Crypto.News
Decrypt reports $198.58 million, Crypto.News reports $138 million (31% apart).
amount taken
$44.4 million
Decrypt
$61 million
Crypto News (CryptoNews.net)
Decrypt reports $44.4 million, Crypto News (CryptoNews.net) reports $61 million (27% apart).
amount taken (drift exploit)
25,710 ETH
CryptoSlate
44,510 ETH
Crypto.News
CryptoSlate reports 25,710 ETH, Crypto.News reports 44,510 ETH (42% apart).
amount taken
$280 million
CryptoSlate
$138 million
Cointelegraph
CryptoSlate reports $280 million, Cointelegraph reports $138 million (51% apart).
amount taken (drift protocol)
$280 million
CryptoSlate
$109 million
Bitcoin Insider
CryptoSlate reports $280 million, Bitcoin Insider reports $109 million (61% apart).
reported value (cash tornado)
$61.56 million
Crypto News (CryptoNews.net)
$46 million
Cointelegraph
Crypto News (CryptoNews.net) reports $61.56 million, Cointelegraph reports $46 million (25% apart).
reported value
$61.56 million
Crypto News (CryptoNews.net)
$46 million
Crypto.News
Crypto News (CryptoNews.net) reports $61.56 million, Crypto.News reports $46 million (25% apart).
amount taken (april)
$138 million
Cointelegraph
$295 million
Crypto.News
Cointelegraph reports $138 million, Crypto.News reports $295 million (53% apart).
amount taken (april)
$138 million
Cointelegraph
$295 million
Altcoin Buzz
Cointelegraph reports $138 million, Altcoin Buzz reports $295 million (53% apart).
reported value
$46 million
Cointelegraph
$61 million
Crypto.News
Cointelegraph reports $46 million, Crypto.News reports $61 million (25% apart).
reported value
$46 million
Cointelegraph
$61.6 million
Altcoin Buzz
Cointelegraph reports $46 million, Altcoin Buzz reports $61.6 million (25% apart).
amount taken (drift)
$109 million
Bitcoin Insider
$295 million
Crypto.News
Bitcoin Insider reports $109 million, Crypto.News reports $295 million (63% apart).
amount taken (drift)
$109 million
Bitcoin Insider
$295 million
Altcoin Buzz
Bitcoin Insider reports $109 million, Altcoin Buzz reports $295 million (63% apart).
reported value (cash tornado)
$109 million
Crypto.News
$153 million
Altcoin Buzz
Crypto.News reports $109 million, Altcoin Buzz reports $153 million (29% apart).
reported value
18,800 ETH
Crypto.News
23,095 ETH
Altcoin Buzz
Crypto.News reports 18,800 ETH, Altcoin Buzz reports 23,095 ETH (19% apart).
Key facts
Drift Protocol suffered an exploit on April 1, 2026, with losses estimated between $280 million and $295 million
285,000,000 USDDisputed figureReported by Crypto.News
Drift attributed the April attack to a North Korean threat group (UNC6862) following a Mandiant forensic investigation
Reported by Cointelegraph
On October 20, wallets linked to the exploiter deposited 25,700 to 25,710 ETH into Tornado Cash over two hours
25,700 ETHDisputed figureReported by Crypto.News
On October 21, the exploiter transferred an additional 18,800 ETH to Tornado Cash
18,800 ETHDisputed figureReported by Cointelegraph
Two-day total transfers to Tornado Cash reached 44,510 ETH worth approximately $109 million
44,510 ETHDisputed figureReported by Cointelegraph
Exploiter wallets retained approximately 56,569 ETH valued at roughly $138 million after October 21 transfers
56,569 ETHDisputed figureReported by Cointelegraph
Drift opened DFX recovery token claims and redemptions on October 1 with a pool holding approximately $3.1 million
3,100,000 USDReported by Crypto.News
A previous transfer of 23,095 ETH worth approximately $44.4 million was sent to Tornado Cash on July 23-24
23,095 ETHDisputed figureReported by Decrypt
What happened
Wallets identified by blockchain analytics firms as belonging to the Drift Protocol exploiter resumed activity on October 20 after roughly two months of inactivity, depositing 25,700 to 25,710 ETH into Tornado Cash over two hours. On October 21, an additional 18,800 ETH was sent to the mixer, bringing the two-day total to 44,510 ETH valued at approximately $109 million. The April 1 exploit on the Solana-based decentralized exchange caused losses estimated between $280 million and $295 million. Drift attributed the attack to a North Korean threat group (UNC6862) following a Mandiant forensic investigation. The protocol opened DFX recovery token claims on October 1 with a pool initially holding about $3.1 million. Analytics sources report differing figures for the October 20 movement and remaining balances.
How the story developed
- Official statement
Drift opens DFX recovery claims
Recovery token claims and redemptions begin with pool holding approximately $3.1 million USDT
- Update
Exploiter resumes activity with large Tornado Cash deposits
25,700-25,710 ETH deposited to Tornado Cash over two hours on October 20 after two months of inactivity
- First report
First report by Crypto.News
Drift exploiter resurfaces after 2 months, moves $61.6M in ETH to Tornado Cash
- Independent corroboration
Independently corroborated by Cointelegraph
Drift exploiter sends $61M ETH to Tornado Cash, holds $194M
- Official statement
Drift attributes attack to North Korean group
Mandiant forensic investigation links exploit to UNC6862, a North Korean threat group
- Update
First Tornado Cash deposits by exploiter
23,095 ETH worth approximately $44.4 million sent to Tornado Cash on July 23-24
- Update
Second day of transfers brings two-day total to 44,510 ETH
Additional 18,800 ETH sent to Tornado Cash on October 21, totaling $109 million over two days
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 20 Oct 2026, 10:19 UTC: Crypto.News — 1 independent source, 1 reports
- 20 Oct 2026, 12:38 UTC: Cointelegraph — 2 independent sources, 2 reports
- 20 Oct 2026, 13:29 UTC: Bitcoin Insider — 3 independent sources, 3 reports
- 20 Oct 2026, 20:46 UTC: Decrypt — 4 independent sources, 5 reports
- 20 Oct 2026, 21:40 UTC: CryptoSlate — 5 independent sources, 6 reports
- 22 Oct 2026, 04:53 UTC: Altcoin Buzz — 6 independent sources, 12 reports
Affected entities
Also mentioned: Chainlink, USD Coin, XRP, Liquid Network
Original sources
Related events
Crypto activity fell 1.6% while market capitalization contracted by $2.1 trillion
Crypto economic activity fell 1.6% to $9.4 trillion through June 30, 2026, while reported market capitalization losses reached $2.1 trillion.
Tether CEO disputes Senate Iran sanctions report, claims proactive freezes cut volumes 94%
Tether CEO Paolo Ardoino disputes a Senate report accusing the company of slow sanctions enforcement, claiming proactive wallet freezes reduced Iran-linked USDT volumes by 94% since 2023.
US Treasury sanctions seven TRON addresses over alleged Tren de Aragua ATM scheme
OFAC added seven TRON addresses holding about $6.1 million to its sanctions list on September 30, alongside eight people and two Mexico-based companies in a Tren de Aragua ATM jackpotting case.
UK crypto trader says armed intruders stole about $800,000 in a knifepoint home invasion
A UK crypto trader posting as 'realist' on X says knife-wielding intruders stole about $800,000 from his home; police have not confirmed the account.
UK sanctions Cryptomus, Heleket and TokenSpot in 38-designation Russia package
The UK sanctioned three crypto platforms and two payment firms on October 8 for allegedly helping Russia evade financial sanctions, linking them to the Kremlin-backed A7 network and sanctioned exchanges Garantex and Grinex.
Chainalysis reports US net bitcoin imports and Canada stablecoin remittance surge
Chainalysis data shows the US became a net bitcoin importer for the first time since 2022 while Canada's crypto remittances to India, China, and the Philippines jumped 141% to $2.36 billion.
