Attack on Drift: $61 Million Transferred to Tornado Cash

Wallets linked to the Drift attack on April 1 transferred 25,700 Ethereum (about $61.56 million) to the cryptocurrency mixer Tornado Cash within two hours on Tuesday. According to Arkham, the tracked addresses of the attacker still hold 81,454 ETH – approximately $198 million. Initially, $295 million was stolen from the Drift protocol.

Deposits were made in batches of 100 ETH (about $237,800) plus chunks of 10 ETH – these sizes match the fixed pools of the mixer, which allow funds to be withdrawn to new addresses and break the public link between sender and receiver. Besides ETH, the wallet holds about $561,600 in other assets – USDT, USDC, Solana, and USDY. Tuesday's transfers continued the first round on July 23–24, when the Drift Exploiter 4 address sent about 23,095 ETH, then valued at $44.4 million, to the same mixer.

On Wednesday, a wallet linked to the attacker transferred another 18,800 ETH – about $46 million – to Tornado Cash. Over two days, 44,510 ETH, or $109 million, was sent to the mixer – nearly 37% of the $295 million stolen from Drift in April; according to DefiLlama, this is the third-largest crypto hack of the year. After Wednesday, wallets marked as linked to the exploit held 56,569 ETH – approximately $138 million.

The attack on April 1 became possible after the attacker gained administrator rights, issued a fake token, and used it to borrow real liquidity. In June, Drift reported that Mandiant linked the attack to the North Korean group UNC6862. According to Drift, the operation was prepared for six months: the group posed as a quantitative trading fund, met with participants in person, and contributed $1 million of their own funds to gain trust.

The total theft amounted to $295.7 million, including $159.3 million in JLP tokens and $71.4 million in USDC, which were later exchanged and transferred to Ethereum. Drift, whose relaunched exchange now operates as Velocity, opened on October 1 for applications and redemptions for the recovery token DFX: one token for each USDT of confirmed losses, totaling about 299.5 million tokens. The pool initially had about 3.1 million USDT, so those who redeemed tokens earlier received approximately 0.0104 USDT per token – about one cent per dollar of losses. The pool receives from 60% to 90% of Velocity's net revenue daily – the share grows with revenue – and Tether has committed to directing up to 127.5 million USDT for the relaunch and recovery. Funds returned through freezes, bounties, or law enforcement will also go there.