Drift Exploiter Moves $61.6M in ETH to Tornado Cash as Recovery Pool Holds $3.1M of a $295M Loss

The wallet cluster linked to the April 1 exploit of Solana-based perpetuals protocol Drift resumed activity on October 20 after roughly two months of silence, depositing 25,700 ETH — about $61.56 million — into the privacy mixer Tornado Cash over a two-hour window, according to on-chain analyst Lookonchain.

The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity. Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).

— Lookonchain (@lookonchain) October 20, 2026

The deposits are the latest chapter in a recovery that has barely begun. Drift’s own records put the April theft at $295,706,374.93 across 19 assets, while the recovery pool meant to repay victims held about $3.1 million in USDT when claims opened on October 1 — roughly one cent for every dollar lost.

A Two-Hour Burst After Two Months of Silence

Lookonchain flagged the movement at about 09:25 UTC on October 20. “The Drift Protocol exploiter, who stole over $270M, is moving ETH to Tornado Cash after 2 months of inactivity,” the account wrote. “Over the past 2 hours, the exploiter has deposited 25,700 ETH ($61.56M) into Tornado Cash and still holds 81,864 ETH ($195M).”

A second tracker, Onchain Lens, published the fuller two-day tally on October 21. “DRIFT EXPLOITER MOVES $109M ETH TO TORNADO CASH,” the account wrote, counting 44,510 ETH — about $109.15 million — moved across October 20 and 21, split into 25,710 ETH on the first day and 18,800 ETH on the second. The post lists two addresses, 0xAa843eD65C1f061F111B5289169731351c5e57C1 and 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7.

The two trackers differ on the dollar figures because each snapshotted ETH at a different price, with ETH trading near $2,481 at the time. The token amounts are the stable unit. What is not in dispute is the pattern: a cluster that had gone quiet since August moved tens of thousands of ETH through the mixer in concentrated bursts, the same method it used in two earlier rounds of Tornado Cash activity over the summer.

The Ledger of the April 1 Theft

Drift’s April 16 incident report breaks the loss into 19 assets. Jupiter’s JLP liquidity token was the largest single line at $159,329,898.68, followed by $71,415,648.65 in USDC, $11,321,165.24 in Coinbase-wrapped bitcoin and $10,426,959.98 in SOL. The remaining 15 assets — USDT, USDS, WETH, dSOL, WBTC, Fartcoin, jitoSOL, syrupUSDC, INF, mSOL, bSOL, EURC, zBTC, USDY and JUP — bring the total to $295,706,374.93.

Drift has said its forensic investigation attributed the attack to a North Korea-linked group, and the protocol disclosed in the same report that it is “actively working with law enforcement and blockchain forensics partners to track and recover stolen assets.” Any funds recovered are directed to the recovery pool. Chainalysis separately estimated the loss at about $285 million.

For the relaunch, Drift is moving its settlement layer from USDC to USDT. Tether is proposing up to $127.5 million and other partners up to $20 million to support user recovery, alongside two independent audits from Ottersec and Asymmetric. A new community-governed multisig will manage core protocol assets, with signers on dedicated signing devices and timelocks on critical administrative actions.

A Recovery Pool Still a Fraction of the Loss

The recovery mechanism Drift opened on October 1 is a fixed-supply token called DFX. One DFX was issued for every USDT of verified loss, capping the supply at 299,500,810.998 tokens, and the token redeems against a pool that held about $3.1 million when claims opened. Drift’s own documentation puts an early redemption at “about 0.0104 USDT per DFX.”

The arithmetic is blunt. A pool of $3.1 million against a loss of $295.7 million is a recovery of about 1.05 percent. Viewed from the other side it is harsher: the $109.15 million the exploiter moved through Tornado Cash in two days is roughly 35 times the entire recovery pool. On October 20 alone, the $61.56 million deposited equaled about 21 percent of the full haul.

Drift’s earlier DFX launch coverage walks through the claim mechanics, and the April theft itself was documented as one of the month’s largest DeFi exploits. The pool is funded once a day at 00:00 UTC from a share of Velocity’s net protocol revenue — 60 percent of the first $30,000, 70 percent of the next $70,000 and 90 percent above $100,000 — until verified losses are repaid. Claims close at 00:00 UTC on January 1, 2028, after which unclaimed DFX is burned.

The mechanics leave victims with a three-way choice that Drift’s documentation states plainly: redeem DFX for USDT at the current redemption amount, sell it on a secondary market such as Raydium, or hold it and let the pool grow as deposits arrive and supply shrinks. Because a redemption burns DFX and removes USDT in the same proportion, the redemption amount itself does not fall when holders exit — each future deposit is simply shared among fewer remaining tokens. The trade-off is time against certainty, and Drift has not tied pool growth to a fixed repayment schedule.

What the Deposits Do Not Prove

A Tornado Cash deposit does not establish what happened to the funds next. The mixer pools deposits so they can be withdrawn from fresh addresses, and moving ETH into it is not proof that the tokens were sold, converted to cash or moved to an exchange. Lookonchain’s framing — “moving ETH to Tornado Cash” — stops at the observable transfer, and the trackers themselves disagree on the remaining balance, with Lookonchain citing 81,864 ETH after the October 20 deposits and Arkham’s entity page later showing about 56,569 ETH.

Freezing or recovering any of the stash would require an exchange or custodian willing to act on the labels, since Ethereum addresses cannot be blocked at the protocol level. That is why Drift’s recovery path runs through a bounty program and law enforcement rather than through the mixer itself.

What is not yet known is whether any of the laundered funds can be clawed back, or whether law enforcement will tie the movement to the actors Drift has named. Until a court or a recovery action produces a result, the North Korea attribution remains an allegation and the $109.15 million figure remains an on-chain estimate rather than a completed liquidation.