An Ethereum wallet closely linked to the massive April 1 exploit of crypto trading protocol Drift has funneled tens of thousands of Ether into the Tornado Cash privacy mixer, draining the address nearly dry in a rapid sequence of transactions that has cast fresh uncertainty over ongoing user fund recovery efforts.
The address, identified by blockchain intelligence platform Etherscan with the label “Drift Exploiter 5,” transferred 25,710 ETH into the Tornado Cash router on October 20. The massive outbound movement effectively emptied the wallet in what marked its first-ever outgoing Ethereum transactions since the assets were initially acquired during the spring security breach.
According to on-chain data and tracking profiles, the wallet held a nominal balance of roughly 3.98 ETH prior to the sudden surge of activity. Meanwhile, broader monitoring by analytical profiling account Lookonchain has previously estimated that the combined network of wallets controlled by the exploiter holds tens of thousands of additional Ethereum tokens. Based on Ethereum’s prevailing market price of approximately $2,450 at the time of the transfer, the batch of tokens moved on October 20 was valued at roughly $63.1 million.
258 Deposits in Two Hours and Thirteen Minutes
The laundering sequence executed by the hacker was methodical and rapid, spanning a little over two hours. In total, the address completed 258 successful deposits into the Tornado Cash router system. The vast majority of these transactions—specifically 257 individual transfers—were executed in uniform increments of 100 ETH each. The sequence concluded with a final, concluding deposit of 10 ETH, bringing the aggregate total of moved funds to 25,710 ETH.
On-chain records show that the first deposit in the aggressive two-hour window was officially confirmed at 07:08:35 UTC within Ethereum block 26,232,203. The final transaction in the sequence was processed less than two and a half hours later, at 09:21:35 UTC, in block 26,232,865.
This latest development arrives more than six months after the initial high-profile security breach rattled the decentralized finance ecosystem on April 1. In the immediate aftermath of the incident, Drift—communicating through updates published via Velocity—initially estimated that approximately $280 million had been siphoned away from the protocol’s infrastructure.
Detailed technical accounts of the attack released by Drift revealed a sophisticated operational security breach involving the takeover of administrative powers vested in the protocol’s Security Council. Investigators found that the perpetrator utilized durable nonce accounts to pre-sign transactions and deliberately delay their execution, ultimately managing to secure unauthorized and misrepresented transaction approvals well in advance of the exploit’s public manifestation.
In the wake of the incident, preliminary internal reviews conducted by Drift indicated that the exploit did not stem from a foundational bug or vulnerability within the platform’s core smart contracts or code programs. Subsequent investigative steps took a deeper turn when Drift commissioned cyber defense firm Mandiant. A formal update published by the protocol on June 4 attributed the sophisticated intrusion to UNC6862, an advanced persistent threat group linked by intelligence analysts to North Korea.
How Recovered Funds Reach Drift Users
As the bad actors behind the multi-million-dollar breach actively work to obfuscate and launder their stolen loot through privacy tools like Tornado Cash, the protocol and its affected community continue to grapple with complex recovery mechanisms.
Drift’s established Recovery Pool serves as the primary conduit through which recovered assets can theoretically make their way back to impacted users. According to the protocol’s governance framework, capital successfully retrieved via asset freezes, bug bounties, or law enforcement cooperation is channeled directly into the pool. This pool is also supplemented by allocations drawn from a designated share of the trading platform’s net protocol revenue.
To operationalize these claims, Drift officially rolled out DFX claims and redemptions at the beginning of October. The protocol allocated precisely one DFX token for every USDT of verified loss experienced by users during the exploit. Under this structure, token holders are granted the ability to redeem their DFX tokens for actual USDT based on the prevailing redemption quote at the time of the transaction. Crucially, any DFX tokens submitted for redemption are permanently burned in the exact same transaction block.
The mechanics of the system mean that the absolute amount of USDT paid out to a user fluctuates depending on the redemption quote active during the exchange, thereby tying direct cash recoveries to the actual capital flowing into the pool over time. Participants who choose to redeem only a portion of their holdings retain their proportionate share of participation for whatever DFX tokens they decide to keep in their possession.
Early pricing metrics underscored the grim reality of recovering massive sums from complex hacks. By early October, public quotes for the redemptions hovered at approximately 0.0104 USDT per DFX, translating to roughly one cent on the dollar for verified losses sustained during the April breach.
Prior financial stabilization proposals outlined by Drift in mid-April had contemplated substantial liquidity injection packages. These included up to $127.5 million sought in coordination with Tether alongside an additional $20 million from various industry partners. The comprehensive financial package was designed to incorporate a revenue-linked credit facility, ecosystem grants, and specialized market-maker loans to help steady the platform’s balance sheet.
While the rapid influx of transactions recorded on October 20 provides a clear accounting of where a significant tranche of the exploiter’s Ethereum holdings has traveled, the ultimate question of how much stolen capital can be successfully intercepted, recovered, and funneled back to the protocol’s recovery pool remains deeply uncertain.
