A cryptocurrency wallet linked to the April exploit of trading protocol Drift moved 25,710 ETH through Tornado Cash on Oct. 20, placing about $63.1 million in assets into the mixer and leaving the address with less than 4 ETH. The transfer adds a new complication to efforts to recover funds for users affected by the attack.
According to CryptoSlate, the wallet is labeled “Drift Exploiter 5” by Etherscan. Its first outgoing Ethereum transactions were completed over two hours and 13 minutes, and the address held approximately 3.98 ETH after the sequence. Lookonchain separately reported that the exploiter wallets it tracks collectively held 81,864 ETH.
258 transfers emptied most of the wallet
The funds were sent to the Tornado Cash router through 258 successful deposits. The wallet made 257 deposits of 100 ETH each and then completed the series with a final 10 ETH transaction, taking the total transferred to 25,710 ETH.
The first deposit was confirmed at 07:08:35 UTC in Ethereum block 26,232,203. The last was recorded at 09:21:35 UTC in block 26,232,865. Based on Ethereum’s average price of $2,450 on Oct. 20, the transfers were valued at roughly $63.1 million.
Tornado Cash is a cryptocurrency mixer, a service designed to pool and redistribute digital assets in a way that can make it more difficult to trace the link between the original sender and later recipients. Moving funds into such a service can therefore complicate efforts to identify where assets eventually go or recover them.
The transfer took place more than six months after the April 1 attack on Drift. In an initial disclosure published on April 2 through Velocity, Drift estimated that approximately $280 million had been withdrawn from the protocol.
What Drift said about the April attack
Drift’s description of the incident focused on a takeover of the protocol’s Security Council administrative powers. The attacker allegedly used durable nonce accounts to pre-sign transactions and delay their execution, allowing unauthorized or misrepresented transaction approvals to be obtained in advance.
In its early update, Drift said its investigation had not identified a bug in its programs or smart contracts. An update published on June 4 said an investigation by Mandiant had attributed the attack to UNC6862, which Drift described as a North Korean threat group.
The latest blockchain movements do not establish how much of the stolen money can still be recovered. They do, however, show that a substantial amount of ETH from one wallet associated with the exploit has been moved into Tornado Cash. The remaining recovery outcome is unresolved.
How recovery claims are structured
Drift’s Recovery Pool is intended to provide a mechanism through which recovered assets can be returned to affected users. According to Drift, the pool can receive funds recovered through asset freezes, the protocol’s bounty process or law-enforcement action. It also receives a share of the trading platform’s net protocol revenue.
Drift opened DFX claims and redemptions on Oct. 1. The system allocates one DFX token for each USDT of verified loss, allowing users to record the size of their claim. Holders can exchange DFX for USDT at the redemption quote available when they redeem the tokens, and the submitted DFX is burned in that transaction.
The amount of USDT paid is therefore tied to the funds available in the Recovery Pool and the quote at the time of exchange. Redeeming part of a DFX holding leaves the holder’s remaining tokens eligible to participate in future pool deposits, while the redeemed portion no longer carries that participation.
As of Oct. 4, the quote established on Oct. 1 was approximately 0.0104 USDT per DFX—about one cent for each USDT of verified loss. Drift had earlier proposed a package involving up to $127.5 million from Tether and $20 million from other partners. The proposal included a revenue-linked credit facility, an ecosystem grant and loans for market makers.
Moneyiar market picture
Moneyiar market data recorded at 11:19 a.m. on Oct. 21, 2026, shows Ethereum at $2,460.4333, up 3.28% over 24 hours and down 1.69% over seven days. NEAR Protocol was $5.1866, up 11.18% over 24 hours and 2.31% over seven days. Plasma stood at $0.080567, up 7.02% over 24 hours and down 0.89% over seven days, while Nexus was $0.000000683, up 2.78% over 24 hours and down 10.77% over seven days.
The ETH transfer illustrates the difference between identifying an on-chain movement and recovering the underlying assets. The wallet’s transactions are visible on Ethereum, but the amount that could ultimately reach Drift’s Recovery Pool—and the funds that may be returned to users—remains unknown.
