Drift Protocol Exploit Sends $122M to Tornado Cash

The move ended two months of near silence from the attacker. Back in July, the same entity pushed about 23,095 ETH through Tornado Cash. Then the wallets went quiet. Now the laundering has restarted at a far larger scale.

A $122M Dash Through Tornado Cash

Analytics account Lookonchain first spotted the activity on October 20. In about two hours, the exploiter deposited 25,700 ETH, worth roughly $61.56 million at the time. The transfers followed a tight pattern. Most were exactly 100 ETH, with one 10 ETH deposit to round out the batch.

The next day brought another wave. Lookonchain tracked a further 24,885 ETH, or about $61.3 million. Other trackers logged smaller tallies. Onchain Lens, for example, counted closer to 44,500 ETH across the two days.

The totals differ by source. Arkham settled on $122.3 million across 520 transfers. The gaps come from wallet aggregation and shifting ETH prices. Still, every tracker agrees the sum ran well into nine figures.

How the Drift Protocol Hack Unfolded

The story starts on April 1, 2026. That day, attackers drained Drift Protocol in roughly 12 minutes. Drift later put the loss at $295.7 million across 19 assets. Chainalysis estimated a slightly lower figure near $285 million.

Two assets dominated the losses. About $159.3 million in JLP and $71.4 million in USDC left the protocol. SOL, cbBTC, and WETH made up much of the rest. The attacker then swapped and bridged most of it to Ethereum.

This was not a classic code exploit. Instead, the attackers ran a social engineering campaign for months. They posed as a trading firm and built trust with the team. Eventually, they compromised Security Council admin privileges.

The crew used pre-signed durable nonce approvals and fake tooling. Once inside, they listed a worthless collateral token called CarbonVote. Then they used it to drain real liquidity from the vaults. The whole drain lasted only minutes.

Why the Drift Protocol Exploiter Used 520 Small Transfers

The pattern looks odd at first. Why split a fortune into hundreds of tiny deposits? The answer lies in how Tornado Cash works. The mixer uses fixed denomination pools, such as 1, 10, and 100 ETH.

Each deposit must match a pool size exactly. So a large sum has to be broken into many equal pieces. The 100 ETH pool did most of the work here. That is why the Drift Protocol exploiter made 257 deposits of 100 ETH.

The method serves a second purpose. Smaller transfers draw less attention than one giant move. They also spread activity across many blocks. As a result, the trail becomes harder to follow.

Tornado Cash breaks the on-chain link between deposits and withdrawals. It relies on zero-knowledge proofs to hide the connection. Large volumes still leave timing and statistical traces. Even so, individual trails get heavily obscured.

North Korea Link Confirmed by Mandiant

The Drift Protocol exploit did not stay anonymous for long. In June 2026, Drift confirmed findings from Mandiant. The forensics firm attributed the hack to a group it calls UNC6862. Mandiant describes it as a North Korean threat group.

UNC6862 overlaps with other known clusters. These include UNC4736, Citrine Sleet, and AppleJeus. Researchers also tie the same ecosystem to the 2024 Radiant Capital hack. So the Drift case fits a wider pattern of state-linked theft.

No real-world identity has surfaced. Attribution points to the group, not to named individuals. On-chain labels remain analytical rather than judicial. For now, the trail ends at the mixer.

What Recovery Looks Like for Drift Protocol Users

Victims face a hard road. Drift opened its DFX recovery claims on October 1. At launch, the pool held only about $3.1 million. That values claims at roughly one cent on the dollar.

There is a longer-term lifeline. Tether has committed a package worth up to $127.5 million over time. Drift also rebuilt its system with help from auditors like Ottersec. The relaunch carries the Velocity branding.

Remaining stolen funds still dwarf the recovery pot. Trackers put the attacker’s leftover holdings between 56,000 and 82,000 ETH. At current prices, that runs well over $100 million. Arkham recently pegged roughly $137 million in labeled wallets.

The laundering drew heavy attention, yet the market barely moved. The DRIFT token already trades far below its 2024 peak. DefiLlama shows protocol TVL near $294 million as of October 22. The headlines added scrutiny, not a fresh sell-off.

What Happens Next

The next question is whether any funds ever come back. Law enforcement could still freeze or trace mixed proceeds. Bounties and seizures remain possible, though far from certain. For victims holding DFX, patience may be the only option left.

This article is for informational purposes only and is not financial advice. Always do your own research before making any investment decision.