A wallet that Etherscan labels “Drift Exploiter 5” sent about 25,700 ETH into Tornado Cash on the morning of 20 October, the first such move by the Drift Protocol hack wallets since July. Coindaro checked the transfers on two block explorers: the wallet’s balance fell from about 25,715 ETH to under 4 ETH between 07:08 and 09:21 UTC, in deposits of 100 ETH and one final deposit of 10 ETH. At $2,382 per ETH, the price at 10:22 UTC, that is roughly $61 million.
The on-chain trackers that raised the alert published different numbers. Lookonchain counted 25,700 ETH ($61.56 million), which matches what the explorers show. Salus counted 19,600 ETH in 196 transactions, an earlier Onchain Lens update gave at least 13,400 ETH, and The Defiant’s headline says $54.8 million. FinWire, which compiled several of these counts, says they were taken at different times and should not be added together.
As of 10:55 UTC, Drift had published nothing about the movement on its updates page.
The Drift hack, on 1 April, drained between $285 million and $295 million from the Solana perpetuals exchange, depending on the count. In its 3 June recovery update, Drift says Mandiant’s investigation attributed the attack to UNC6862, which Drift describes as a North Korean threat group.
A Tornado Cash deposit is not a cash-out. It hides which wallet the coins came from, but the ether still has to come out of the mixer, and withdrawals can still be studied. Most of the haul has not moved: about 81,450 ETH sits in the other wallets Etherscan tags as Drift exploiter addresses.
Drift exploiter and Tornado Cash: what the trackers and the chain show
Lookonchain, the on-chain investigator most widely quoted on the story, posted the first full account. Its message, as reproduced by FinWire, reads: “The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.” The $270 million is below the $285 million to $295 million used by Chainalysis, Hacken and Drift itself, and the gap since the last wave is closer to three months than two.
Salus, a security firm that says it runs a Tornado monitoring system, saw 19,600 ETH go in over 196 transactions and said the wallet ending in 57c1 still held 6,114.15 ETH at that point. That wallet is Drift Exploiter 5. By 09:21 UTC it had sent almost everything, so the Salus figure reads as a count taken while the deposits were still running.
Onchain Lens published earlier still, when its count stood at 13,400 ETH or more. The Defiant ran the story with a $54.8 million headline; its article body did not load for us, so we could not see its ETH figure, time window or source.
| Source | What it measures | ETH | Dollar value |
|---|---|---|---|
| Lookonchain (via FinWire, PANews) | Deposits over about two hours | 25,700 | $61.56M |
| Salus (via FinWire) | 196 transactions seen by its Tornado monitoring | 19,600 | $46.81M |
| Onchain Lens (via FinWire, KuCoin News) | Earlier update, minimum amount | 13,400 or more | about $32M |
| The Defiant | Headline figure; article body not readable by Coindaro | not stated | $54.8M |
| Coindaro check (Etherscan, Blockscout) | Fall in the Drift Exploiter 5 balance, 07:08 to 09:21 UTC | about 25,710 | about $61.2M at 10:22 UTC price |
Each dollar value is the source’s own conversion, made at its own time, except the last line, which is Coindaro’s calculation. The spread between the trackers comes from timing: a count published mid-run is lower than one published after the last deposit.
About 81,450 ETH still sits in wallets tagged as Drift exploiter addresses
Etherscan groups five addresses under its Drift Exploit label. At 10:51 UTC on 20 October, Coindaro read their balances: Drift Exploiter 1 held 24,881.98 ETH, Drift Exploiter 3 held 56,568.38 ETH, Drift Exploiter 5 3.98 ETH, and Exploiters 2 and 4 almost nothing. That adds up to about 81,454 ETH, roughly $194 million at the 10:22 UTC price. Neither of the two large wallets sent any ether on 20 October up to that time.
The trackers’ own balance figures differ again. Lookonchain says the exploiter still holds 81,864 ETH, about $195 million. The Defiant’s subheading puts the five Etherscan-labelled wallets at about 84,164 ETH. Onchain Lens, as relayed by KuCoin News, listed 93,965 ETH plus 477,375 USDY and 1.33 SOL, about $224.59 million, in the wallets it tracks. The Etherscan label does not necessarily cover every address the attacker controls: Arkham groups nearly twenty wallets in its “Drift Protocol Exploiter” cluster, Cryptopolitan reported in July.
Exploiter 5 is not a new wallet. Blockscout’s balance history shows it received its first ether on 1 April, the day of the hack, and had held about 25,715 ETH since 19 April without moving it until this morning.
What the explorers cannot show is where the ether goes next. Tornado Cash breaks the link between a deposit and a withdrawal, and FinWire said the publicly accessible Arkham tracker did not let it confirm the figures either.
How the Drift hack unfolded on 1 April
Drift runs a perpetual futures exchange on Solana. The loss is put at about $285 million by Chainalysis and in Hacken’s second-quarter report, and at about $295 million by Drift. Our report on the third-quarter hack totals shows the trackers also disagree on the quarter’s count.
The attack was prepared for months. According to Chainalysis, as reported by Cryptopolitan, people posing as a quantitative trading firm attended industry events and deposited more than $1 million on the platform to build trust. Devices were then compromised.
The technical step used Solana’s durable nonces, a feature that lets a transaction be signed now and sent later. The attackers obtained pre-signed approvals from two of the five members of Drift’s Security Council. They also inflated the price of a token called CarbonVote Token (CVT) through wash trading and posted it as collateral.
Thirty-one withdrawals followed in about 12 minutes, and at least 20 other Solana projects were disrupted, Chainalysis found. PeckShield said Drift’s total staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">value locked fell by more than half.
On who did it, Coindaro relies on one statement: Drift’s 3 June update, which says Mandiant’s investigation attributed the exploit to UNC6862 and that the group’s tactics align with historical North Korean operations.
July: the first Tornado Cash wave
On 23 and 24 July, the wallet Etherscan labels Drift Exploiter 4 sent 23,095.1 ETH, about $44.4 million at the time, to Tornado Cash, plus 0.85 ETH to deposit addresses at the Bybit exchange. PeckShield published those figures, Cryptopolitan reported; crypto.news credits on-chain researcher JL (0xJaelle) with spotting the move first. That wallet now holds 0.0038 ETH and sent nothing on 20 October.
The July run showed up on the mixer’s side too. L2Beat data cited by The Defiant counted 968 Tornado Cash deposits on 23 July, the busiest day of 2026, with about $57 million of ETH going in, some $44 million of it from the Drift exploiter in under two hours.
Eighty-nine days separate the two waves. Both followed the same pattern: one wallet, a long pause, then a run of 100 ETH deposits lasting around two hours.
Drift’s recovery plan does not count on the stolen ETH
For Drift users, the practical question is the recovery plan, laid out on 5 May and reported by CoinDesk. Each dollar of verified loss is matched by one recovery token, now called DFX. The blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool started with about $3.8 million of remaining protocol assets and is to be fed by exchange revenue, up to $127.5 million from Tether linked to performance, and up to $20 million from partners. None of those sources is the stolen ether.
Drift is relaunching with Tether’s USDT instead of Circle’s USDC as its core settlement currency, Decrypt reported in April. In its 3 June update the company said it would relaunch as the “largest USDT-based perpetual exchange on Solana”. DFX claims and redemptions opened on 1 October, according to Drift’s updates page, and stay open until 1 January 2028, FinWire says.
Some money was stopped. About $3.36 million of USDC linked to the hack was frozen, CoinDesk reported in May, and Drift offers a bounty of 10% of any recovered assets. We found no published outcome of the bounty, and no arrests or seizures.
The Drift raid was not the only large April hack. On 18 April an exploit of Kelp’s rsETH bridge cost nearly $280 million, by CoinDesk’s count; our LayerZero project page covers what that attack changed for the messaging protocol.
What a Tornado Cash deposit does and does not prove
Tornado Cash is a set of smart contracts on Ethereum. Users deposit a fixed amount of ETH into a pool (0.1, 1, 10 or 100 ETH) and later withdraw it to a fresh address with a cryptographic proof, which breaks the visible link between the two wallets. Our guide to DeFi explains how such contracts run without an operator.
A deposit only puts the coins in the pool. To spend the ether, the exploiter has to withdraw it, then usually swap it, bridge it or send it to a service that pays out in cash. Analysts can still try to match withdrawals with deposits through timing, amounts and the addresses that receive them.
The mixer’s legal position has changed since the US sanctioned it in 2022. The Fifth Circuit ruled on 26 November 2024 that the Treasury had overstepped its authority by sanctioning Tornado Cash’s immutable smart contracts, and the Office of Foreign Assets Control removed Tornado Cash from its sanctions list on 21 March 2025. Co-founder Roman Semenov remains on that list.
Developer Roman Storm was convicted in August 2025 of conspiring to run an unlicensed money transmitting business; the jury could not agree on the money laundering and sanctions conspiracy charges. Judge Katherine Polk Failla has set the retrial on those two counts for 26 April 2027, Decrypt reported, while Storm’s motion for acquittal is still pending.
What is still unknown, and what to watch
The deposits are confirmed on-chain; their purpose is not. We do not know whether any of the July or October ether has already come out of Tornado Cash, or whether the bounty has produced anything. Drift had not commented by 10:55 UTC, and we found no statement from Arkham on the new transfers.
Two wallets still hold most of the ether: Drift Exploiter 3 with about 56,568 ETH and Drift Exploiter 1 with about 24,882 ETH. Any new transfer from them will be visible on their Etherscan pages as soon as it is mined.
Other signs to look for are a Drift statement, the first large withdrawals from the 100 ETH pool, and any freeze announced by an exchange that receives them. For DFX holders, the recovery pool’s funding stays the same whatever happens to the ETH in the exploiter’s wallets. The claims window closes on 1 January 2028.