A digital wallet linked to the Drift Protocol hacker has reactivated after three months of dormancy. Between July 23 and July 24, 2026, the attacker moved 23,095.1 ETH worth $44.4 million to transaction mixing service Tornado Cash. This movement marks a new chapter in last April’s crypto heist that cost the protocol nearly three hundred million dollars.
Data from on-chain tracker Onchain Lens revealed a consistent laundering pattern. The address labeled “Drift Exploiter 4” processed hundreds of transactions, depositing batches of 100 ETH, 10 ETH, and 1 ETH into the Tornado Cash router. For the 100 ETH deposits, executions were carried out multiple times within minutes to obscure the trail. The attacker also sent 0.85 ETH to Bybit deposit addresses across four separate transfers.
Although tens of millions of dollars have begun moving out, the attacker still holds the bulk of the loot. A remaining 107,165 ETH worth approximately $201 million sits untouched in the original wallet.
Lead Investigator Steps Away From Case
As fund flows began moving across the Ethereum network, crypto sleuth ZachXBT took a step back. He announced he was stopping his tracking of the Drift exploit funds, stating that the task is impossible for an individual without institutional-grade support. To date, Drift is not listed as a client or donor for ZachXBT’s operations.
At the same time, ZachXBT criticized stablecoin issuer Circle, highlighting that $232 million in stolen USDC flowed seamlessly across Circle’s cross-chain infrastructure before the hacker swapped it into ETH.
The April attack itself did not exploit a smart contract vulnerability, but instead used social engineering to breach operational access. The hacker needed just 12 minutes to drain $295.7 million in USDC, JLP, SOL, WETH, and Bitcoin-related assets. Analysis by Google’s Mandiant confirmed that the mastermind behind the attack is the North Korean hacking group tracked under the codename UNC6862.
Compensation Plans Remain Unclear
Post-incident recovery efforts remain underway, though details are still scarce for the public. Tether previously offered up to $127.5 million in support funds to cover victim losses, followed by Drift’s intention to issue recovery tokens.
Back on April 16, Drift floated the idea of a bounty program to catch the hacker, supported by Arkham and Bybit. However, as the hacker freely launders funds through Tornado Cash today, the final execution of that bounty program remains uncertain.
The retreat of third-party trackers like ZachXBT serves as a bitter reminder for victims: tracking funds already in the hands of state-sponsored hackers requires real intelligence apparatus, not just independent monitoring on social media.
Sourced from crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
