A wallet linked to the Drift Protocol hack has sent approximately $61 million in Ether (ETH) to Tornado Cash, a service known for obscuring transaction trails. The transfer, which involved 25,700 ETH, took place over two hours on Tuesday after a two-month period of inactivity, according to blockchain analytics platform Lookonchain.
The exploiter’s addresses still hold about 81,454 Ether, valued at roughly $194 million, as reported by Arkham. Crypto mixers like Tornado Cash pool funds from multiple addresses, making it significantly harder to trace the origin and destination of the funds.
The Drift Protocol hack, which occurred on April 1, resulted in losses of about $295 million. A forensic investigation by cybersecurity firm Mandiant later attributed the attack to UNC6862, a North Korean threat group. Drift, a Solana-based decentralized exchange, has been working on recovery efforts, including the distribution of DFX recovery tokens to affected users.
The hack ranks as the third-largest crypto exploit of 2026, following the $387 million Bitget hack and the $320 million Liquid Network exploit, according to DefiLlama. Drift opened claims and redemptions for DFX recovery tokens on October 1, with the recovery pool initially holding about $3.1 million.