Drift Exploit Tornado Cash Deposits: What ETH Traders Know

Key takeaways

• Wallets linked to the April 1 Drift Protocol exploit deposited 25,700 ETH, about $61.56 million, into Tornado Cash on Oct. 20, 2026, according to Decrypt.
• Decrypt says the deposits came in 100 ETH and 10 ETH batches, matching Tornado Cash's fixed pool sizes, and that an earlier round of 23,095 ETH was mixed on July 23-24.
• Reported figures for the attacker's remaining ETH conflict: Decrypt cites 81,454 ETH (about $198.58 million), while crypto.news cites 56,569 ETH ($138 million) after later deposits.
• Drift's DFX recovery token launched Oct. 1 at about 0.0104 USDT per token, with the Recovery Pool holding about 3.11 million USDT against roughly $295 million in user losses.
• XPERTRAX data shows ETH at $2,495, up 2.38% in 24 hours, so the mixing activity has not coincided with visible price weakness.

What moved on Oct. 20

Wallets tied to the April 1 Drift Protocol hack sent 25,700 ETH, worth about $61.56 million, into Tornado Cash on Tuesday, according to Decrypt. The deposits took roughly two hours. The same addresses had reportedly been quiet for about two months before that. For traders, the Drift exploit Tornado Cash flow matters less as a headline than as a signal about what the holder intends to do with a very large stack of ether.

Decrypt, citing Arkham Intelligence transfer data, says the funds went in as batches of 100 ETH (about $237,800 each) plus smaller 10 ETH chunks. Those sizes match Tornado Cash's fixed deposit pools, so the pattern looks deliberate rather than accidental. Decrypt also notes an earlier round on July 23-24, when an address labeled "Drift Exploiter 4" sent about 23,095 ETH, then worth around $44.4 million, into the mixer.

How the Drift hack worked and who is blamed

According to Decrypt, the attacker gained admin powers over Drift's vaults on Solana, introduced a fake token and used it to borrow real liquidity. Drift's own asset breakdown puts the haul at $295.7 million, led by $159.3 million in JLP and $71.4 million in USDC. Most of it was later swapped and bridged to Ethereum, which explains why the proceeds now sit in ETH.

Decrypt also reports that Drift said in June that the forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Drift described a six-month operation in which the group posed as a quantitative trading firm. Attribution here rests on Drift's account as relayed by Decrypt, not on an independent finding we could verify.

The remaining balance is disputed

The numbers for what the attacker still holds do not agree across outlets. Decrypt says Arkham's entity page tracks 71 addresses linked to the attacker, and that after Tuesday's deposits they still held 81,454 ETH, roughly $198.58 million at the time, plus about $561.6K in USDT, USDC, Solana and USDY.

A later crypto.news headline reads "Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH," and says labeled wallets retained 56,569 ETH after the latest deposits. Cointelegraph's headline also speaks of $109 million over two days, while TFTC's headline says $61 million was sent and $194 million is still held. We could not confirm the bodies of those later pieces. The likeliest reading is that more mixing happened after Decrypt published, but that is our inference, not a confirmed timeline.

Readers should treat any single balance as a snapshot. If you track this on Arkham, check the timestamp before quoting a figure.

What it means for ETH traders

Depositing into a mixer is not the same as selling. Tornado Cash obscures where coins came from; it does not convert them to dollars. The attacker would still need to withdraw and then move the ETH through exchanges, OTC desks or other routes to cash out, and nothing in the reporting shows that has started. So there is no confirmed new selling pressure on Ethereum from this activity.

XPERTRAX data currently shows ETH at $2,495, up 2.38% over 24 hours, and Bitcoin at $84,498, up 2.37%. Both moved together, which suggests the market is not pricing in a Drift-specific supply shock. That is consistent with how large the rest of the market is relative to even the higher reported balances, though we are not putting a number on that comparison.

Our view is that the risk is a tail one. If withdrawals from the mixer begin to hit exchanges in size, short bursts of volatility around those flows are plausible. Traders holding leveraged ETH positions may want tighter risk limits while that uncertainty lasts; our guide to crypto risk management and position sizing covers the basics. This is analysis, not a forecast, and the data does not support calling a direction.

The North Korea angle

If the attribution to a North Korean group holds, this fits a familiar pattern of state-linked actors laundering proceeds in stages and waiting between rounds. We have looked at related cases before, including why Bybit's North Korea win changes nothing for the broader threat picture. The gap between the July and October rounds fits that staged approach, though two data points are thin evidence of a schedule.

Drift users are still waiting on recovery

For victims, the contrast is stark. The Drift Foundation opened DFX recovery-token claims on Oct. 1, issuing one DFX per USDT of verified loss. Total supply is fixed at 299,500,810.998 DFX, and the Recovery Pool held about 3.11 million USDT at launch. Each DFX redeemed for about 0.0104 USDT, roughly one cent per dollar lost. The Foundation's Sept. 30 update puts the total taken from users at about $295.4 million.

Coingape reports that Tether pledged up to 127.5 million USDT, with partners adding another 20 million, and that the pool is also fed by Velocity revenue. The Block reported that, as of the Friday after launch, 216,480 DFX had been redeemed for roughly 2,250 USDT. According to crypto.news, the claim window closes on Jan. 1, 2028, when unclaimed tokens will be burned.

The stolen ETH, at any of the reported balances, is far larger than what the pool held at launch. Since the mixer deposits make recovering those coins harder, victims' prospects seem to depend more on the pledged funding and pool revenue than on clawing back stolen assets. That is our assessment, and the Foundation has not said otherwise in the material we reviewed.

What to watch next

• Withdrawals from Tornado Cash pools that later reach centralized exchanges.
• Updated Arkham balances for the 71 tracked addresses, with timestamps.
• Further batches of 100 ETH deposits, which would suggest more rounds are coming.
• Changes in the DFX redemption rate as the Recovery Pool receives pledged funds.

The facts so far are narrow: a large deposit burst, disputed leftover balances and no confirmed sell-off. Until stolen ETH shows up on trading venues, the market impact is likely to stay limited.

Sources

• Wallet drift exploit sends 61 million ethereum tornado cash (decrypt.co)
• Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash (finance.yahoo.com)
• Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH (crypto.news)
• North Korea's Drift Haul: $61M Through Tornado Cash, $194M Still Free (tftc.io)
• Drift DFX Claims Live: Recovery Token Redeems for 0.0104 USDT, Tether-Backed Pool Explained (solanacompass.com)
• DFX Goes Live: Drift Users Can Claim 1 Token Per $1 Lost as Recovery Pool Starts at $3.11M (coingape.com)
• Drift opens DFX recovery claims with initial payouts near 1% of losses (crypto.news)
• Drift opens exploit recovery claims with initial payouts of just over 1% of user losses (theblock.co)