On October 20, 2026, a wallet connected to the Drift Protocol exploit transferred $61 million in Ether to Tornado Cash. The attacker deposited 25,700 ETH over two hours, ending a sixty-day dormancy period according to Lookonchain transaction data.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.
Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).https://t.co/FRtFrS7rew pic.twitter.com/9ISUIlkHvT
— Lookonchain (@lookonchain) October 20, 2026
Tornado Cash breaks deterministic blockchain links by pooling user deposits into shared smart contracts. This mechanism obscures audit trails, making forensic tracking harder for law enforcement attempting to follow outflows to centralized off-ramps.
Similar laundering techniques have appeared across multiple breaches, including large-scale Tornado Cash mixer deposits documented by security researchers. Despite this transfer, the exploiter still controls 81,454 ETH valued at roughly $194 million, according to Arkham Intelligence records.
Drift Protocol, a decentralized perpetuals exchange on Solana, suffered $295 million in losses on April 1, 2026. The attacker drained liquidity pools before swapping the stolen assets into Ethereum across decentralized cross-chain bridges.
Forensic attribution to North Korean threat actors
Cybersecurity firm Mandiant conducted an exhaustive technical audit of the April incident. In June 2026, Drift confirmed through an official forensic investigation that the breach was orchestrated by UNC6862, a North Korean state-backed cyber group.
State-sponsored hacking syndicates regularly target decentralized finance protocols to fund state operations. Moving assets from Solana to Ethereum allowed UNC6862 to access deeper liquidity pools and mature privacy networks designed to resist transaction monitoring.
The remaining $194 million balance sits across several monitored addresses. Blockchain analysts report that the transfers occurred in consistent batches, suggesting automated batching scripts intended to minimize slippage within the privacy pools.
Compensation structures and DFX token claims
To mitigate user losses, Drift launched DFX token recovery claims on October 1, 2026. These tokens grant affected depositors legal and financial claims over a dedicated reserve pool established to repay outstanding balances.
The fund began operations with $3.1 million in initial capital, supported by recurring exchange fees and operational revenue. In addition, any capital seized or repatriated through legal channels will automatically flow into this remediation contract.
According to documentation from Drift, users have until January 1, 2028, to redeem their DFX allocations. This extended timeline allows protocol revenue to accumulate gradually and increase distributions over successive quarters.
Wider impact across decentralized finance security
The Drift incident currently ranks as the third-largest decentralized finance hack of 2026. DefiLlama data indicates that quarterly cryptocurrency exploit losses have surged significantly, driven by sophisticated infrastructure attacks against exchange architectures.
Only two security breaches exceeded Drift during the year: the $387 million Bitget breach and the $320 million Liquid Network compromise. Together, these three incidents account for over $1 billion in capital losses across major ecosystems.
Security firms emphasize that cross-chain bridges and oracle systems remain primary targets for sophisticated threat actors. As protocols implement multi-signature controls, attackers increasingly focus on private key compromises and complex governance exploit vectors.
On-chain tracking teams continue to monitor the exploiter’s addresses for further outbound transactions. It remains unconfirmed whether UNC6862 will attempt to liquidate the remaining $194 million or maintain its current dormant holding pattern.
The next scheduled distribution for the DFX recovery pool will occur alongside Drift’s November revenue audit.
This article is for informational purposes only and does not constitute financial advice.
