Addresses linked to the April 2026 hack of the Drift Protocol decentralized exchange have transferred approximately 44,510 ETH, valued at $109 million, into the Tornado Cash mixer. The transactions occurred between October 20 and October 21, 2026, in two separate tranches.
The first transfer consisted of 25,710 ETH, worth between $61 million and $63 million, followed by a second transfer of $46 million. Despite these movements, the wallets still hold an estimated 56,569 ETH, equivalent to approximately $138 million.
The April 1, 2026, exploit of the Solana-based platform resulted in total losses of approximately $295 million, marking it as the third-largest theft of 2026. Previous laundering activity occurred in July 2026, when 23,095 ETH, worth about $44 million, was moved to the mixer.
Attribution analysis suggests with medium-high confidence that the attack was conducted by groups linked to North Korean state actors, identified as UNC4736 and UNC6862. Most stolen assets were bridged to Ethereum, facilitating the use of the Ethereum-based mixer.
On October 1, 2026, Drift initiated a claims process for DFX recovery tokens, supported by a pool of approximately $3.1 million in USDT. Research indicates that early redemption rates for these tokens have remained low.
