Drift Protocol Hackers Move 13,400 Ethereum (ETH) Into Tornado Cash

Drift Exploiter 5 Sends 13,400 ETH to Tornado Cash

Wallets tied to last spring’s Drift Protocol robbery woke up after roughly two months of silence, and the Ethereum (ETH) they control is on the move again. On-chain trackers Onchain Lens and Lookonchain, working from the Arkham entity dashboard for the attackers, recorded a fresh wave of mixer deposits inside the past day. One address that analysts label Drift Exploiter 5 pushed 13,400 ETH, about $32 million, into the contracts of Tornado Cash, a mixing protocol that pools deposits and withdrawals so the chain record no longer ties a sender to a recipient. The address had sat still for the past two months. The same dashboard showed a remaining balance of roughly $195.25 million, held primarily in ether. Analytics platforms including MistTrack put total daily movement across the related wallets even higher, at up to 25,700 ETH, or roughly $61.5 million.

The deposits follow a deliberate pattern. Each transfer is exactly 100 ETH, a slice size the trackers say was chosen to avoid sharp swings in the Ethereum price and to keep attention away from the final selling points. The uniform slice also weakens the direct sender-to-recipient link in the public ledger, the very link automated tracing tools depend on. Mixers sit in a wider family of Ethereum privacy tools; zero-knowledge builds such as Aztec Network approach the same goal with proofs rather than pooled deposits. This is the attackers’ second major laundering campaign. In July the same wallets withdrew about $44 million through the mixer using a similar slicing method. What remains untouched is the larger prize: on-chain data shows attacker balances still holding between 82,000 and 94,000 Ethereum (ETH), worth up to $224 million. Law enforcement froze only about $9.2 million in August, and every tranche that now crosses into the mixer makes a further seizure harder to execute, both technically and legally.

Six Months of Setup, 12 Minutes to Drain $285 Million

The ether now dissolving into the mixer was stolen on April 1, 2026, when Drift Protocol, a decentralized exchange running an automated market maker model on the Solana Layer 1 blockchain, lost $285 million in 12 minutes. The heist stands among the largest of the year, and investigation findings describe a level of preparation that has since made it a case study in cybersecurity circles. Blockchain intelligence firms including TRM Labs and Chainalysis attribute the attack to UNC4736, a North Korean state-sponsored group also tracked as Citrine Sleet. The operation unfolded over six months. The runway let the group build cover, contacts and credibility before acting. The group posed as a legitimate venture fund, met Drift developers in person at international conferences and deposited $1 million of its own money into the platform’s pools to build a clean record. The final stage moved through software the platform’s team touched every day: hidden vulnerabilities in Cursor and VSCode let the attackers compromise the devices of the exchange’s Security Council members and intercept admin keys. Cursor and VSCode are code editors used across the software industry. A fake CarbonVote token then served as fictitious collateral, presented as though it backed the treasury, and the platform’s real reserves were withdrawn against it. The sequence let the attackers drain the platform in 12 minutes once the keys were in hand.

Drift’s response so far is modest against those losses. A compensation program built on DFX tokens started on October 1, with a buyback fund assembled with support from Tether. At the current stage the fund covers only about 1% of users’ net losses, and the team says it plans to grow the pool with future platform revenue while the stolen coins keep changing owners on the open market. No published timeline closes the gap to full repayment.

A $224 Million Overhang

The mixer run matters more for recovery than for spot pressure. Once the bulk of the loot is inside Tornado Cash, the $9.2 million frozen in August stands as nearly the whole seizure record, and the remaining balance becomes a supply overhang that can surface as ether at unpredictable hours. For an asset of Ethereum’s market cap, the drip is not noise. That pressure stacks onto flows our desk already tracks, including a recent $20 million USDC whale move onto Hyperliquid, and it lands in a divided market: Dan Gambardello calls the recent 13% monthly drop a normal correction. Security tooling is scaling in parallel, with Mastercard’s stablecoin security risk tool set for rollout in 2027. For Drift users the math is thinner: a 1% payback so far, while the stolen ether keeps changing owners on the open market.