A cluster of wallets linked to the $285 million Drift Protocol exploit became active again on October 20, 2026, following two months without transactions. Within two hours, the hacker transferred roughly 25,700 ETH worth $61.56 million to Tornado Cash, according to Lookonchain. The transfers have not exhausted the stolen funds: the wallets still hold 81,864 ETH valued at approximately $195 million. What stands out is not just the transfer speed, but the hundreds of millions of dollars that remain stored.
Transfer Route to Tornado Cash
The flow of funds to the mixer was recorded by several on-chain observers with varying figures due to observation time lags. Onchain Lens initially noted 13,400 ETH worth $32 million entering Tornado Cash. Lookonchain later updated that figure to 25,700 ETH as tracking continued. This discrepancy stemmed from differing observation windows on the blockchain rather than two separate transfer waves.
A separate source reported that a single wallet deposited 19,600 ETH worth $46.81 million across 196 transactions. Tornado Cash was used to obscure the trail: the protocol pools crypto deposits from multiple parties and allows withdrawals via different addresses, breaking the chain of transaction tracking.
How the $285M Protocol Was Breached
The Drift exploit occurred on April 1 when attackers gained administrative control through transaction approvals from members of the protocol’s Security Council. That access was secured after the perpetrators spent months posing as representatives of a trading firm and building rapport with Drift contributors.
The attackers then exploited the durable nonce feature on the Solana network, a pre-signed transaction mechanism that remains valid until executed. Through this feature, they pushed through approval of a fake token, CarbonVote Token (CVT), as collateral and manipulated its price to siphon the protocol’s real assets.
Losses from the incident were substantial: Chainalysis estimated Drift lost $285 million, representing more than half of the protocol’s total value locked (TVL) at the time. Drift itself later detailed that total stolen tokens reached $295.7 million.
Traces of North Korean Hacking Group
Blockchain forensics firms point to the same culprit behind the theft. Elliptic found that Drift’s transaction patterns and laundering techniques were consistent with North Korean hacker attacks. A Mandiant investigation attributed the incident to UNC6862, a North Korea-based threat group. Those findings align with Drift’s earlier conclusion linking the hack to state-sponsored cyber operations.
For the crypto industry, the Drift breach demonstrates that a fatal vulnerability can begin with months of undercover deception as a business partner. With 81,864 ETH still held by the hackers, efforts to launder the stolen assets appear poised to continue.
As reported by crypto.news.
Also read: Google Cuts Quantum Errors 40-Fold - Bitcoin Encryption Now Requires Under 500,000 Qubits
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
