Skip to content
EVENT / TOPICHistorical

Drift Exploit Funds Moved to Tornado Cash, Recovery Uncertain

3 reports3 sources10/20/2026 updated

Current overview (not historical)

AI overview

A wallet linked to the April 1 Drift protocol exploit transferred roughly $61 million worth of ETH to Tornado Cash, reducing its balance to less than 4 ETH after a series of 258 deposits. The account, which had accumulated about $194 million in ETH, is suspected of exploiting a vulnerability for arbitrage before laundering the proceeds. The move to Tornado Cash, a privacy‑enhancing protocol, raises concerns about the ability to trace and recover the stolen assets. Drift claims that recovered funds will be placed into a recovery pool, but progress on that front remains unclear. The incident highlights the ongoing challenge of securing DeFi protocols and the complexities of tracking illicit funds in the crypto ecosystem.

Written with AI from the reporting · updated 10/20/2026

Latest developmentOct 21, 05:40
Drift hacker moves $63.1 million to Tornado Cash, nearly emptying wallet
Explore the timeline, relations and evidence
Expand the detailed fact route and sources

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Unclassified fact stationOct 20, 20:46single sourcereport-time onlyrevised

    Drift exploiter sends $61M ETH to Tornado Cash

    Read original source ↗ CointelegraphReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Subject：
    drift exploiter
    Action：
    sends
    Object：
    $61M ETH to Tornado Cash
    Occurred (fact side)：
    not recorded
    Cointelegraph ↗Report pageRevision 2 · currently revised
    Published (valid side)：
    Oct 20, 20:38
    First seen (known side)：
    Oct 20, 20:46
    Fact stationSingle source · one-sided claimRevisedReport-time only

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

  2. 2Unclassified fact stationOct 21, 00:00recorded Oct 21, 04:58single sourcerevised

    钱包向 Tornado Cash 存入 25,700 ETH

    Read original source ↗ DecryptReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Subject：
    钱包
    Action：
    向 Tornado Cash 存入
    Object：
    25,700 ETH
    Occurred (fact side)：
    Oct 21, 00:00
    Decrypt ↗Report pageRevision 2 · currently revised
    Published (valid side)：
    Oct 21, 04:46
    First seen (known side)：
    Oct 21, 04:58
    Fact stationSingle source · one-sided claimRevised

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

  3. 3Unclassified fact stationOct 20, 00:00recorded Oct 21, 06:15single sourcerevised

    Drift hacker washes $63M through Tornado Cash

    Read original source ↗ CryptoSlateReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Subject：
    Ethereum wallet labeled Drift Exploiter 5
    Action：
    sent 25,710 ETH into Tornado Cash in 258 deposits
    Object：
    25,710 ETH
    Occurred (fact side)：
    Oct 20, 00:00
    CryptoSlate ↗Report pageRevision 2 · currently revised
    Published (valid side)：
    Oct 21, 05:40
    First seen (known side)：
    Oct 21, 06:15
    Fact stationSingle source · one-sided claimRevised

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

Uncertainty marks flag where to check the sources; they are not proven causation.

Report timeline

Explore every side through dated source reports.

Oct 21
  1. CryptoSlateRelated fact: single sourceSource report revised
    Drift hacker moves $63.1 million to Tornado Cash, nearly emptying wallet

    Report first recorded Oct 21, 06:15

    A wallet labeled "Drift Exploiter 5" moved 25,710 ETH (worth about $63.1 million) into Tornado Cash in 258 deposits on Oct. 20, 2026. The wallet was nearly emptied in two hours and 13 minutes, leaving under 4 ETH. The funds originated from the April 1 exploit of the Drift protocol, which attributed the attack to a North Korean threat group. Drift says recovered funds will enter its Recovery Pool, but recovery progress remains uncertain.

    Read original source ↗
  2. DecryptRelated fact: single sourceSource report revised
    Wallets linked to April Drift exploit deposit $61.56 million in Ethereum to Tornado Cash

    Report first recorded Oct 21, 04:58

    Wallets tied to the April 1 Drift exploit deposited 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over roughly two hours on Tuesday. Arkham data shows the exploiter's 71 tracked addresses still hold 81,454 ETH, worth roughly $198 million, after a first round of 23,095 ETH in July. The deposits landed in batches of 100 ETH, about $237,800 each, matching Tornado Cash's fixed deposit pools. The April 1 exploit, which hit Drift's vaults on Solana after the attacker gained admin powers, resulted in a haul of $295.7 million.

    Read original source ↗
Oct 20
  1. CointelegraphRelated fact: single sourceFact occurrence time unverifiedSource report revised
    Drift exploiter moves $61 million ETH to Tornado Cash, wallet holds $194 million

    Report first recorded Oct 20, 20:46

    A Drift protocol account exploited a vulnerability and transferred 61 million ETH to Tornado Cash, a mixing service. The wallet now holds a total of 194 million ETH. The transaction follows the exploiter's alleged use of the protocol's flaw for arbitrage.

    Read original source ↗

Event discussion

Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.

Open GitHub Discussions