Drift Exploiter Moves $61 Million in Ether to Tornado Cash

A wallet linked to the April 1, 2026 hack of Drift Protocol sent about $61 million in ether to Tornado Cash on Tuesday, October 20, 2026, after about two months of inactivity. The move revives a case that victims are still trying to recover from, with most of the stolen funds still out of reach.

The wallet deposited 25,700 ETH into the mixer over two hours, according to blockchain analytics account Lookonchain. Wallets tied to the exploiter still hold about 81,454 ETH, worth about $194 million, according to Arkham.

Money is moving again through a tool built to hide its trail, while a far larger sum still sits in wallets linked to the same exploiter.

Money on the move again

Mixers pool funds from many addresses and blur the trail, which makes tracing and recovery harder. When a dormant wallet linked to a major hack sends funds to a mixer, investigators and victims read it as a step toward cashing out or splitting funds into harder to track paths.

The October 20, 2026 transfer does not prove where the ether will go next. It shows the exploiter is active again, and tracing gets harder once funds enter a mixer.

The April attack and the North Korea link

Drift, a Solana based decentralised exchange, lost about $295 million in the April 1, 2026 attack. It was one of the largest decentralised finance losses of the year, and it hit users who had trusted the protocol with trading balances.

A forensic investigation by Mandiant attributed the attack to UNC6862, a North Korean threat group, Drift said in June 2026. That attribution raised the stakes beyond one protocol. Funds tied to state linked groups are harder to recover, and sanctions and law enforcement tools often move slower than on chain transfers.

A small recovery pool against a large loss

Drift opened claims and redemptions for DFX recovery tokens on October 1, 2026. The recovery pool held about $3.1 million at launch and grows from exchange revenue and any recovered funds.

The contrast is hard to miss. Victims are claiming from a pool worth about $3.1 million at launch while about $194 million still sits in the exploiter wallets. Even if revenue adds to the pool over time, the gap between what was taken and what is available now remains wide.

By DefiLlama count, the Drift exploit is the third largest crypto hack of 2026, behind the Bitget loss of about $387 million and the Liquid Network exploit of about $320 million.

Why mixers matter for recovery

Every move into Tornado Cash makes the next step harder to follow. Recovery teams rely on clear trails to exchanges, bridges and services that can freeze funds. A mixer breaks that clarity by pooling and redistributing funds.

What happens next depends on where the mixed funds surface. If they reach a regulated service, there may be a chance to flag or freeze them. If they move through further mixers or informal channels, that chance falls. For Drift users, the October 20 move is a reminder that the April loss is not a closed chapter.