Drift Protocol Exploiter Moves $61M in ETH to Tornado Cash

The transfers mark a significant shift in the movement of funds stolen during the April 1 attack on the Solana-based derivatives platform. While monitoring services like Lookonchain and Salus reported varying figures—ranging from 13,400 to 25,700 ETH—these discrepancies reflect different snapshots of a complex, multi-wallet laundering process. Despite these outflows, the exploiter reportedly retains control over roughly 81,864 ETH, a stash valued at approximately $195 million.

Forensic investigations, including an analysis by Mandiant, have attributed the breach to UNC6862, a group linked to North Korea. The attackers gained control of the protocol by exploiting Solana’s durable nonce feature, allowing them to manipulate multisignature approvals and drain assets after months of social engineering. In response to the breach, Drift launched a recovery program on October 1, issuing DFX tokens to affected users. These tokens are backed by a pool funded by the platform’s Velocity trading arm and a $127.5 million commitment from Tether, with claims processable until January 2028.