Ethereum from the Drift hack: the attacker moves up to $61 million into Tornado Cash

The proceeds of the attack on Drift Protocol are moving again. On October 20, 2026, wallets that observers attribute to the attacker forwarded a large part of the stolen ether to the Tornado Cash mixer, after the addresses had lain still for around two months. Figures for the sum diverge and range between $32 million and $61.6 million. For European investors this is no distant piece of news: laundered ether ends up on the open market, and accepting it unknowingly risks a frozen deposit.

25,700 ether in two hours: the figures on the October 20 movement

The largest value comes from the analytics service Lookonchain. According to its reading, 25,700 ether worth around $61.56 million flowed into Tornado Cash within two hours on October 20. The first report of the day came from Onchain Lens and was smaller: 13,400 ether, equivalent to roughly $32 million, out of an address that observers label "Drift Exploiter 5". The security firm Salus independently counted 19,600 ether, around $46.81 million, spread across 196 individual transactions.

To put the magnitude in context: one ether costs around $2,436, or €2,168, on October 20, 2026. The 25,700 ether in the Lookonchain calculation therefore amount to roughly €55.7 million.

Three observers, three sums: the method explains the $32 million to $61 million range

The range is not a contradiction but a consequence of how it is measured. Each service watches its own groups of addresses, cuts the time window differently and converts at different prices. Onchain Lens reported early in the day; Lookonchain updated later and thereby captured more transactions. Salus evaluated a third slice. Only the range is therefore reliable, not any single number. Citing the smallest figure understates the day's movement; taking only the largest attaches you to a snapshot.

Mixer: a mixer is a contract on the blockchain that pools deposits from many users and later pays them out in equal-sized pieces, so that deposit and withdrawal can no longer be linked unambiguously.

What a crypto mixer such as Tornado Cash does technically

Tornado Cash works with fixed denominations and a cryptographic proof. Whoever deposits receives a secret note. On withdrawal, that note proves they deposited at some point without showing which of the deposits was theirs. The more participants sit in the pool at the same time, the larger the crowd in which a single sum disappears. That is precisely the point of the 196 individual transactions Salus counted: many small steps are harder to attribute than one large transfer.

The technique does not erase the trail completely. Analytics firms work with time windows, amounts and the behaviour of the addresses afterwards. The fact that three services noticed the movement independently on the same day shows how closely such addresses are now watched.

81,500 ether remain with the attacker: the rest of the proceeds

The October 20 movement has not used up the proceeds. Arkham Intelligence subsequently put the remaining balance at around 81,454 ether, roughly $194 million. Lookonchain arrived at around 81,864 ether and therefore roughly $195 million. Earlier estimates ran between 82,000 and 94,000 ether and up to $224 million. The attacker thus still commands a multiple of what passed through the mixer that day.

Two months of stillness before the movement

The rhythm stands out. The addresses lay inactive for around two months before turning active on a large scale in a single day. That pattern is familiar from other cases: waiting until public attention has faded means meeting fewer observers, and services that no longer check an address daily.

The attack of April 1, 2026: $295.4 million on a Solana platform

Drift Protocol was a trading venue for derivatives on the Solana blockchain. On April 1, 2026 it lost the bulk of the customer funds deposited with it in short order. The Drift Foundation itself speaks in its recovery report of around $295.4 million taken from users. Individual trade publications name $285 million and a sequence lasting twelve minutes; the first reports in the week of the attack came in above $270 million. The range of $285 million to $295.4 million is therefore the reliable frame.

What became of the platform was described by this newsroom in October: a successor launched under the name Velocity. The details are set out in the report Velocity replaces Drift after the hack.

Mandiant and Chainalysis both point to North Korea but name different groups

Here the investigators diverge, and that belongs in the picture. In its report of June 3, 2026 the Drift Foundation relays the investigation by Mandiant, which by its own account attributes the attack unambiguously to the group UNC6862, a North Korean threat actor. TRM Labs and Chainalysis point instead to UNC4736, also known as Citrine Sleet, likewise with a state link to North Korea. The two attributions share the origin and differ on the group named. No conclusive public finding by an authority exists.

Involved in tracing the funds, according to the foundation, are Mandiant, zeroShadow and SEAL 911. A comparable case lies only weeks back: at the exchange Bitget, Chainalysis attributed a theft of $387 million to the same origin, as set out in our report on the Bitget attribution.

$9.2 million frozen: what the Drift Foundation says about recovery

The recovery record is sober. Of the roughly $295.4 million, about $9.2 million had been frozen according to the foundation, so around 3 percent. Frozen does not mean recovered: the foundation writes that release runs through law enforcement and takes time. Proceeds had already gone through Tornado Cash in August, so the October 20 movement is not the first.

Affected users can register claims through a compensation pool that runs under the ticker DFX. The first payouts in early October came to slightly more than 1 percent of user losses, and claims were opened at one cent per token. In addition there is a public bounty of 10 percent on funds successfully recovered, which the foundation has posted jointly with Bybit.

Tornado Cash has been off the US sanctions list since March 2025

A widespread misunderstanding concerns the legal status of the mixer. The US Treasury removed Tornado Cash from the sanctions list on March 21, 2025. The notice carries the title "Cyber-related Designation Removal; North Korea Designation Update and Removal" and lists the TORNADO CASH entry together with the associated ether addresses among the deletions. It can be read in the announcement by the US sanctions authority OFAC. It followed the judgment of the Fifth US Circuit Court of Appeals in Van Loon v. Department of the Treasury of November 26, 2024.

The removal concerns the tool, not the act. Stolen funds remain stolen, whichever route they take. For one of the founders the designation under the North Korea programme even remained in place under the same notice, while the cyber designation fell away. Concluding from this that a deposit with mixer history is unproblematic confuses sanctions law with anti-money-laundering supervision.

Anti-money-laundering law: an exchange in Germany may hold a deposit back

Providers serving customers in Germany fall under the Money Laundering Act. These firms have to check the origin of assets, report suspicious activity to the Financial Intelligence Unit, and may hold a transaction back until it is clarified. In practice they work with the same analytics services that are tracking the Drift proceeds. If an incoming sum appears at a short distance from a mixer or from a flagged address, the system fires.

For the customer that means: the credit may sit unprocessed, a withdrawal is stopped, and the provider asks for evidence of origin. A case like that is resolved through documents, not through objection. Purchase receipts, bank statements and a traceable path from entry to deposit are then the only basis on which anything can be clarified. Buying through licensed firms gives you that record anyway. An overview of regulated providers is kept by this newsroom in the comparison of crypto exchanges.

Custody and deposit routes: where second-hand ether gets noticed

The risk arises not when buying at a licensed exchange but at the edges. Direct deals with unknown counterparties, swap offers in chat groups and payments from strangers for services are the usual entry points for funds with a history. Accepting ether from such sources and depositing it at an exchange later puts the burden of proof on you.

Self-custody changes nothing about origin. A hardware wallet rules out third-party access to the keys and is the most effective measure against phishing and attacks on services, but it does not turn flagged funds into unflagged ones. The devices and their handling are set side by side by this newsroom in the hardware wallet comparison. The benefit lies in protecting your own holdings, not in cleaning up a history.

With a stopped withdrawal, evidence counts for more than objection

Answer the provider's enquiry in full first, with date, counterparty and amount. Then assemble the transaction hashes that show the path of the funds back to your own entry point. If you do not know the origin yourself, say so openly, because an invented explanation weighs more heavily with a supervisor than a gap.

In context: a mixer deposit is no evidence of a sale

One distinction to close with, which gets lost in many reports. That 25,700 ether flow into a mixer says nothing about whether and when they will be sold. The funds then sit in a contract, and the destination of the withdrawal is open. No immediate pressure on the ether price can be derived from this, especially as the sum is small against daily trading volume. Reading the movement as a sell signal attributes to the data something it does not carry. The transaction is documented, the intention behind it is not.

Three points remain open: which group is actually behind the attack, when the frozen $9.2 million will be released, and where the remaining 81,500 ether or so will go.

Drift proceeds: 81,500 ether still sit with the attacker

1. Check which routes brought ether into your holdings, and file purchase receipts for every entry point. For future purchases, the safe route runs through licensed providers from the exchange comparison.
2. Move larger holdings into your own custody so that an attack on a service does not reach your keys. The devices in the hardware wallet comparison show the differences in handling and backup design.
3. Avoid direct deals with unknown counterparties. If a deposit stalls regardless, answer the provider's questions with evidence rather than objection.

(As of October 20, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)