Addresses associated with the April Drift Protocol exploit moved 25,700 Ethereum, valued at approximately $61.56 million, into the Tornado Cash mixer on Tuesday. The transactions occurred over a two-hour period, following a two-month window of inactivity for these wallets.
Data from Arkham Intelligence indicates the funds were deposited in batches of 100 ETH and 10 ETH. These amounts align with the mixer's fixed deposit pools, which are designed to obscure the connection between the original sender and the final recipient.
Following the recent transfers, the attacker's wallets still hold 81,454 ETH, currently valued at roughly $198.58 million. Additionally, the wallets contain approximately $561.6 thousand in other assets, including USDT, USDC, Solana, and USDY.
The April 1 exploit resulted in the theft of $295.7 million from Drift's vaults on Solana. The attacker gained administrative access to introduce a fake token and borrow liquidity. Forensic firm Mandiant attributed the incident to the North Korean group UNC6862.
Drift, now operating as Velocity, launched a recovery program on October 1 using the DFX token. The recovery pool receives 60% to 90% of the protocol's daily net revenue, supplemented by a commitment of up to $127.5 million from Tether to support the relaunch.
