Drift Exploit Wallet Moves $61 Million in ETH to Tornado Cash
A wallet linked to the $295 million Drift exploit sent 25,700 ETH—about $61 million—through Tornado Cash in two hours, according to Decrypt. A separate report says the attacker moved more funds over two days and that linked wallets still held $138 million in Ether, underscoring that the reported balances and transfer totals vary by snapshot.
Key takeaways
- A wallet linked to the April Drift exploit sent 25,700 ETH, worth about $61 million, through Tornado Cash in two hours.
- The Drift exploit drained $295 million in April.
- Decrypt said roughly $198 million remained under the attacker’s control.
- CoinTelegraph reported $109 million in mixer transfers over two days and $138 million in Ether still held afterward.
A wallet linked to the April Drift exploit sent 25,700 ETH, worth about $61 million, through Tornado Cash in two hours, Decrypt reported on October 20. The April attack drained $295 million from the Drift protocol, and the attacker has been linked to North Korea.
Tornado Cash is a cryptocurrency mixer that pools and redistributes transactions to make it harder to trace where funds go. The transfer does not establish that the funds have been converted to cash or spent.
How much Ether is still linked to the Drift exploit?
The reports give different snapshots of the funds. Decrypt says the attacker still controls roughly $198 million. CoinTelegraph reports that wallets linked to the hack sent $109 million in Ether to Tornado Cash over two days and still held $138 million after a further $46 million transfer on Wednesday.
Those figures should not be treated as a single, settled balance: the reports describe different transfer windows and wallet snapshots. What they agree on is that substantial Ether linked to the $295 million exploit continues to move through the mixer.
What should Drift users take from the transfers?
The transfers are a money-tracing development, not evidence that Drift users have recovered funds or that the protocol has repaid losses. For people affected by the hack, the useful signal is whether authorities or investigators identify funds that can be frozen or returned—not simply whether the attacker moves them between addresses.
That distinction matters in crypto thefts more broadly: on-chain activity can make transfers visible, but visibility does not itself give victims control over the assets. Unlike a collateral deposit that can be monitored for liquidation risk, as in a reported ETH transfer to protect a DAI debt position, these transfers are associated with funds taken in an exploit and sent through a mixer. The reports do not say what enforcement or recovery steps, if any, will follow.
Frequently asked questions
How much ETH did the Drift exploiter send to Tornado Cash?
Decrypt reported that a wallet linked to the exploit sent 25,700 ETH, worth about $61 million, through Tornado Cash in two hours. CoinTelegraph reported $109 million in Ether transfers over two days.
How much money was stolen in the Drift exploit?
The April Drift exploit drained $295 million, according to the reports.
Does sending ETH to Tornado Cash mean the attacker cashed it out?
No. The reports describe Ether being sent through a mixer, which can make transaction tracing harder. They do not say the funds were converted to cash or spent.
Live on-chain data from our sister sites: