A cryptocurrency wallet linked to the April hack of Drift Protocol has transferred about $61 million worth of Ether to Tornado Cash, a service designed to make transaction trails harder to follow.
The wallet sent 25,700 ETH to the crypto mixer over roughly two hours on Tuesday, according to blockchain analytics platform Lookonchain. The transfer followed about two months of inactivity by the address, bringing renewed attention to funds connected to one of the largest crypto attacks of 2026.
Funds moved after two months of inactivity
Arkham data showed that addresses associated with the exploiter still held about 81,454 ETH, valued at approximately $194 million. The amount transferred to Tornado Cash therefore represented only part of the Ether linked to the wallet group.
Crypto mixers combine funds from multiple addresses and then redistribute them, making it more difficult to trace the movement of individual deposits. Tornado Cash has been used for this purpose in cryptocurrency transactions, although the transfer itself does not establish how the remaining funds will be handled.
The latest movement was reported by Cointelegraph, which cited the Lookonchain and Arkham data on the transfers.
Drift attack left users with recovery claims
Drift Protocol is a decentralized exchange built on the Solana blockchain. The platform reported losses of about $295 million from the April 1 hack.
In June, Drift said a forensic review by cybersecurity company Mandiant had attributed the attack to UNC6862, a North Korean threat group. That attribution provided a reported link between the exploit and a state-linked cybercrime actor, while the movement of funds has continued to be monitored through blockchain addresses.
Drift began opening claims and redemptions for DFX recovery tokens on Oct. 1. These tokens give affected users a claim on a recovery pool. The pool held about $3.1 million when it launched and is funded by exchange revenue as well as any funds recovered from the hack.
The recovery mechanism means that the movement of Ether remains relevant to affected users because any recovered funds can contribute to the pool. However, the source material does not say that the transfer to Tornado Cash has resulted in a recovery or loss of those assets.
One of 2026’s largest crypto exploits
According to DefiLlama, the Drift incident ranks as the third-largest crypto hack of 2026. The two larger incidents listed in the source material were the $387 million Bitget hack and the $320 million Liquid Network exploit.
The scale of the Drift loss, together with the value still associated with the exploiter’s addresses, highlights the difficulty of recovering assets after a decentralized-finance attack. Blockchain records can make transfers visible, but services that obscure transaction trails can complicate efforts to connect funds with their eventual destination.
Moneyiar market picture
Moneyiar data at the stated times showed Ethereum at $2458.3903029672, up 3.05% over 24 hours but down 1.65% over seven days, as of 2026-10-21 11:04 +03:30. Plasma (XPL) was $0.080065333, up 6.84% in 24 hours and down 1.55% over seven days, as of 11:03. Rootstock Infrastructure Framework (RIF) stood at $0.0757837273, up 2.3% over 24 hours and down 7.06% over seven days, as of 11:04. Capricorn (APR) was $0.131504117, down 2.15% over 24 hours and up 0.59% over seven days, as of 2026-10-06 14:14 +03:30.
