Opinion. On Tuesday, after about two months of silence, wallets labeled as the Drift Protocol exploiter sent 25,700 ETH, about $61.6 million, into Tornado Cash over roughly two hours, according to Lookonchain. Arkham data cited by Cointelegraph shows the exploiter’s addresses still holding about 81,450 ETH, worth roughly $194 million. Drift says it lost about $295 million in the April 1 attack on the Solana-based exchange. In June, Drift said a Mandiant investigation attributed the attack to UNC6862, a North Korean threat group.
Update, Oct. 21: A second batch of ETH from the exploiter’s wallets moved into Tornado Cash on Wednesday morning, so the remaining balance is now lower than the figure above. Trackers differ on the size of the new batch.
Here’s the part that should bother people. This money hasn’t been hiding. Drift’s own September update laid out the trail: the stolen funds were bridged to Ethereum and split across four wallets holding about 130,259 ETH. One wallet sent about 23,094 ETH to Tornado Cash on July 23. The other three, holding 107,165 ETH, hadn’t moved at all. For six months, everyone could see the wallets, the labels and the balances. Drift says about $9.2 million has been frozen so far. That’s roughly 3% of the loss.
Tuesday’s move came from that untouched pile. Subtract 25,700 from 107,165 and you land near the 81,450 ETH Arkham still shows, so the numbers line up.
Don’t let the story turn into “ban the mixer” again. Washington already tried that. Treasury sanctioned Tornado Cash in 2022, then lifted those sanctions in March 2025 after the Fifth Circuit ruled that its immutable smart contracts weren’t property that could be blocked. A state-linked hacking group was always going to find a laundering route. The real question is why nine figures of attributed stolen ether could sit untouched on a public ledger for half a year while the recovery tally barely moved. Speculation, labeled: freezing works at the edges, at exchanges and stablecoin issuers, and patient attackers simply wait until attention fades before they walk through the middle. Tuesday looks like that playbook.
The victims are left with a bounty program and a recovery pool. Drift has partnered with Bybit on a 10% bounty for recovered funds, and its DFX recovery tokens opened for claims on October 1, backed by a pool that held about $3.1 million at launch. That’s a long way from $295 million.
Now the market angle, and it’s all speculation, labeled: money that goes into a mixer usually doesn’t hit the order book right away. It comes out in pieces and often gets swapped into other assets through bridges or over-the-counter desks. If the remaining ~81,500 ETH follows, that’s about $194 million that could eventually be sold. That’s a real number, but it’s spread over weeks or months and set against a deep ETH market. Watch the outflows and the bridges. Don’t treat one headline as a sell signal.
Hardwire’s read: give the on-chain sleuths credit, because they caught this in real time. Then ask why catching it isn’t the same as stopping it. Six months of open-ledger visibility recovered about 3% of the loss. That isn’t a privacy problem. It’s an enforcement problem.
This is opinion, not investment advice.
Sources: Cointelegraph; Lookonchain; Lookonchain; Arkham