Drift Protocol Exploiter Moves $44M Through Tornado Cash

The movement of funds, valued at approximately $44.4 million, occurred between July 23 and July 24. On-chain records from PeckShield and Etherscan show the exploiter processing hundreds of transactions, frequently depositing batches of 100 ETH into the mixing service to decouple the link between the origin and destination addresses. Smaller amounts—totaling 0.85 ETH—were traced to wallets tagged as Bybit deposit addresses, signaling potential attempts to move assets onto an exchange.

Prominent investigator ZachXBT, who had been tracking the stolen assets, stated he would not continue monitoring these specific funds. He noted that the resources required to track a nine-figure, North Korea-linked operation are prohibitive for a single person, especially without institutional backing. Mandiant has previously linked the April attack to the threat group UNC6862, which exploited social engineering and compromised access rather than a smart contract vulnerability.

While the protocol previously announced a recovery bounty program in collaboration with Arkham and Bybit, the status of these rewards remains opaque. Drift continues to work with law enforcement and forensic firms to recover assets for a user compensation pool, though the use of Tornado Cash adds a significant layer of difficulty to these efforts. As the trail grows cold, the protocol remains focused on rebuilding its infrastructure and implementing stricter signing controls to prevent future breaches.