Wallets tied to the April 1 Drift Protocol exploit deposited 25,700 Ethereum, worth about $61.56 million, into the crypto mixer Tornado Cash over roughly two hours on Tuesday, according to blockchain data from Arkham Intelligence. The addresses had been inactive for about two months before the transfers.
The deposits were made in batches of 100 ETH, each worth about $237,800, along with smaller 10 ETH chunks. Those amounts match Tornado Cash's fixed deposit pools, which allow users to withdraw funds later from new addresses and obscure the link between sender and receiver.
Remaining holdings
Arkham's entity page, which tracks 71 addresses linked to the attacker, shows 81,454 ETH still held in those wallets after Tuesday's deposits, worth roughly $198.58 million at current prices. The wallets also contain about $561,600 in other assets, including USDT, USDC, Solana, and USDY.
Tuesday's transfers follow an initial round on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.
Exploit background
The April 1 exploit targeted Drift's vaults on Solana after the attacker gained admin powers, introduced a fake token, and used it to borrow real liquidity. Drift's asset breakdown puts the total haul at $295.7 million, led by $159.3 million in JLP—the Jupiter Liquidity Provider token—and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum.
Arkham's portfolio view still lists one Fartcoin in the exploiter's holdings, worth about 15 cents, far below the $4.1 million in Fartcoin that Drift says was taken in April.
Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person, and deposited $1 million of its own money to build trust. In June, Drift said forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Recovery efforts
Drift, whose relaunched exchange now operates as Velocity, opened claims for its DFX recovery token on Oct. 1, issuing one token for every USDT of verified loss, totaling about 299.5 million tokens. The recovery pool held about 3.1 million USDT at launch, so early redemptions paid roughly 0.0104 USDT per token, or about a penny on the dollar.
The pool receives a daily share of between 60% and 90% of Velocity's net protocol revenue, scaling up as daily revenue grows. Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, the bounty, or law enforcement also go into the pool.
