Drift hacker moves $109M in stolen Ether through Tornado Cash

Funds from $295 million Solana exchange hack laundered over two days; North Korean group linked to exploit

By LineZotpaper

Published21 October 2026

Read Time1 min

Addresses linked to the exploiter of Solana-based decentralized exchange Drift have moved approximately $109 million in Ether through the crypto mixer Tornado Cash over a two-day period, according to blockchain data tracked by Onchain Lens and Arkham. The transfers represent nearly 37 percent of the $295 million stolen from Drift in April, one of the largest crypto hacks this year.

The Drift exploiter sent $61 million in Ether to Tornado Cash on Tuesday and another $46 million, or 18,800 ETH, on Wednesday, bringing the two-day total to 44,510 ETH, roughly $109 million. The transfers make the stolen funds significantly harder to trace.

Despite these moves, wallets associated with the exploiter still held 56,569 Ether, worth approximately $138 million, according to Arkham data. The April 1 hack of the Solana-based DEX resulted in around $295 million in losses. Security consultant Mandiant attributed the attack to a North Korean threat group.

Drift has opened claims for DFX recovery tokens since October 1, giving affected users a claim on a recovery pool launched with about $3.1 million. The pool is funded by exchange revenue and any recovered assets. The Drift exploit ranks as this year's third-largest crypto hack, according to DefiLlama.

Analysis

Why This Matters

The movement of stolen funds through mixers highlights the persistent challenges in recovering assets from crypto exploits
The involvement of a North Korean threat group underscores ongoing geopolitical risks in the decentralized finance sector
Drift's recovery token mechanism provides a real-time test for how DeFi protocols can attempt restitution following major hacks

Background

Drift is a decentralized exchange built on the Solana blockchain. In April 2026, it suffered a $295 million exploit. Security firm Mandiant traced the attack to a group linked to North Korea. Tornado Cash is a cryptocurrency mixing service that has been under US sanctions for its use in money laundering.

Key Perspectives

Drift Users and Recovery Token Holders: They have received DFX tokens representing a claim on a recovery pool currently worth several million dollars, funded by exchange revenue and recovered assets.

The Exploiters: Focused on liquidating stolen crypto assets, using mixers to obscure the flow of funds to evade law enforcement and sanctions.

Critics and Skeptics: The continued use of Tornado Cash despite sanctions illustrates the difficulty of enforcing financial restrictions on decentralized code. Recovery pools may only return a fraction of stolen value to victims.

What to Watch

Whether the remaining $138 million in Ether is moved or liquidated
Any response from law enforcement or blockchain analytics firms to trace the laundered funds
The future value and redemption rate of Drift's DFX recovery tokens

Sources

Drift exploiter sends $109M in Ether to Tornado Cash in 2 days · Cointelegraph.com News

Checked

12 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedAddresses linked to the Drift exploiter moved about $109 million in Ether through Tornado Cash over two days.Cointelegraph.com News: “The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million”
Partly supportedFunds from the Drift hack were laundered over two days.Cointelegraph.com News: “The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million”
SupportedA North Korean group was linked to the exploit.Cointelegraph.com News: “which its security consultant Mandiant attributed to a North Korean threat group.”
SupportedThe transfers represent nearly 37% of the $295 million stolen from Drift in April.Cointelegraph.com News: “The transfers to Tornado Cash make the funds harder to trace and represent nearly 37% of the $295 million stolen from decentralized exchange (DEX) Drift in April.”
Partly supportedOnchain Lens and Arkham tracked the transfer data.Cointelegraph.com News: “taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.”
SupportedThe exploiter transferred $61 million on Tuesday and $46 million, or 18,800 ETH, on Wednesday.Cointelegraph.com News: “A Drift exploiter-linked wallet transferred 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday. The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday”
SupportedThe two-day total was 44,510 ETH, or $109 million.Cointelegraph.com News: “taking its two-day total to 44,510 ETH, or $109 million”
Partly supportedThe transfers make the stolen funds significantly harder to trace.Cointelegraph.com News: “The transfers to Tornado Cash make the funds harder to trace”
SupportedWallets associated with the exploiter still held 56,569 Ether, worth about $138 million.Cointelegraph.com News: “The Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million after Wednesday’s flurry of transfers, Arkham data shows.”
SupportedThe April 1 Drift hack resulted in around $295 million in losses.Cointelegraph.com News: “The Solana-based DEX reported about $295 million in losses from the April 1 hack”
SupportedDrift opened claims for DFX recovery tokens on October 1, giving affected users a claim on a pool launched with about $3.1 million.Cointelegraph.com News: “Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users a claim on a pool that launched with about $3.1 million”
SupportedThe Drift exploit ranks as this year’s third-largest crypto hack.Cointelegraph.com News: “The attack ranks as this year’s third-largest crypto hack, according to DefiLlama .”