Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH

cryptonews10-21 19:59

Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2677676761?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-21 19:59","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2677676761","market":"fut","top_or_hot":-1,"title":"Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH","media":"cryptonews","content":"<div>\n<p>Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by...</p>\n\n<a href=\"https://crypto.news/drift-hacker-109m-eth-tornado-cash/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nDrift exploiter sends $109M to Tornado Cash, retains $138M in ETH\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-21 19:59 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/drift-hacker-109m-eth-tornado-cash/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by...</p>\n\n<a href=\"https://crypto.news/drift-hacker-109m-eth-tornado-cash/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"FETH","symbol_name":"以太币ETF-Fidelity","start_time":0,"source_url":"https://crypto.news/drift-hacker-109m-eth-tornado-cash/","article_id":"2677676761","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/drift-hacker-109m-eth-tornado-cash/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2677676761","pubTimestamp":1792583976,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by the attacker.Wallets linked to the April Drift exploit reportedly transferred 44,510 ETH, worth $109 million, to Tornado Cash on October 20–21.Wednesday’s activity involved approximately 18,800 ETH worth $46 million, following an estimated $61 million in transfers on Tuesday.Arkham-labeled exploiter wallets reportedly retained 56,569 ETH, valued at $138 million, after the latest deposits.Drift attributed its April attack to a North Korean threat group following an investigation by Mandiant.According to blockchain tracker Onchain Lens, the wallets deposited 44,510 ETH into the mixing service on October 20 and 21, including approximately 18,800 ETH valued at $46 million on Wednesday.Following Wednesday’s transfers, addresses labeled as the Drift exploiter held approximately 56,569 ETH, valu","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"FETH":"以太币ETF-Fidelity","ETHA":"以太坊ETF-iShares","ESK":"REX-Osprey ETH + Staking ETF","ETHD":"ProShares UltraShort Ether ETF","YETH":"Roundhill Ether Covered Call Strategy ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","ETHE":"最大以太坊ETF-Grayscale","EZET":"以太坊ETF-Franklin","TETH":"21Shares Ethereum ETF","EETH":"以太币期货ETF-ProShares","ETHI":"Defiance Leveraged Long Income Ethereum ETF","ETCO":"Grayscale Ethereum HIGH Income ETF","ETHT":"ProShares Ultra Ether ETF","QETH":"以太坊ETF-Invesco Galaxy","ETU":"T-Rex 2X Long Ether Daily Target ETF","ETHU":"2倍以太币期货ETF-Volatility Shares","SETH":"1倍做空以太币期货ETF-Proshares","ETHV":"以太坊ETF-VanEck","ETH":"低成本以太坊ETF-Grayscale","ETHW":"以太坊ETF-Bitwise","BTF":"比特币&以太币期货ETF-CoinShares"},"translate_title":"Drift exploiter 向 Tornado Cash 发送 1.09 亿美元，保留 1.38 亿美元 ETH","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"ETHU":0.6,"EETH":0.6,"ETHW":0.6,"FETH":0.6,"ETHT":0.6,"TETH":0.6,"ESK":0.6,"ETHA":0.6,"BTF":0.6,"ETHI":0.6,"ETQ":0.6,"YETH":0.6,"ETH":0.6,"ETHE":0.6,"ETHD":0.6,"ETHV":0.6,"QETH":0.6,"ETCO":0.6,"ETU":0.6,"SETH":0.6,"EZET":0.6},"content_text":"Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by the attacker.\n\n\nSummary\n\n\n\nWallets linked to the April Drift exploit reportedly transferred 44,510 ETH, worth $109 million, to Tornado Cash on October 20–21.\nWednesday’s activity involved approximately 18,800 ETH worth $46 million, following an estimated $61 million in transfers on Tuesday.\nArkham-labeled exploiter wallets reportedly retained 56,569 ETH, valued at $138 million, after the latest deposits.\nDrift attributed its April attack to a North Korean threat group following an investigation by Mandiant.\nThe exchange opened DFX recovery claims on October 1, initially backed by a pool holding approximately 3.1 million USDT.\n\n\n\nAccording to blockchain tracker Onchain Lens, the wallets deposited 44,510 ETH into the mixing service on October 20 and 21, including approximately 18,800 ETH valued at $46 million on Wednesday.\n\nDRIFT EXPLOITER MOVES $109M $ETH TO TORNADO CASHThe Drift Protocol exploiter transferred 44.51K $ETH (~$109.15M) to Tornado Cash over the past two days.· October 20: 25.71K $ETH (~$63.04M)· October 21: 18.8K $ETH (~$46.11M)Addresses:… pic.twitter.com/udDVTmEBje— Onchain Lens (@OnchainLens) October 21, 2026\n\nThe October 21 transfers followed roughly 25,710 ETH sent on Tuesday, when blockchain monitors recorded deposits worth approximately $61 million. Combined, the two batches represent more than one-third of the $295 million lost in Drift’s April 1 exploit, based on their estimated dollar values when transferred.\nAttribution of the transactions rests on addresses identified as belonging to the attacker. Tornado Cash accepts cryptocurrency deposits into privacy pools, making it harder to follow funds once they are withdrawn to new addresses. A mixer deposit does not, by itself, establish that the stolen assets have been exchanged for cash or recovered by authorities.\nThe movement comes after a period of relative inactivity. On October 20, Lookonchain reported approximately 25,700 ETH deposited within two hours, while different monitoring accounts published lower interim totals as the transactions were still taking place.\nThe latest two-day figure covers the complete period cited by Onchain Lens, not the amount observed by each tracker at the same point in time. The reported 44,510 ETH figure and the quoted $109 million are estimates based on the transfer activity and Ether prices around the deposits.\nExploiter wallets retain $138 million after latest transfers\nFollowing Wednesday’s transfers, addresses labeled as the Drift exploiter held approximately 56,569 ETH, valued at $138 million, according to Arkham Intelligence data cited in the October 21 reporting. The figure describes the tracked wallets at that snapshot, not every asset necessarily controlled by the perpetrators.\nOn Tuesday, the corresponding holdings estimate had been roughly 81,454 ETH, worth $194 million. Those balances changed as funds moved and as Ether’s market price fluctuated.\nPast transactions complicate the picture. In August, wallets connected to the same incident had already transferred around $44 million worth of ETH through Tornado Cash, prompting renewed questions about how much could ultimately be frozen or returned to victims.\nAs crypto.news previously reported, investigators faced difficulties tracking the stolen assets through cryptocurrency mixers.\nThe April incident was one of the year’s largest decentralized finance thefts. Drift initially faced differing loss estimates because investigators valued affected tokens at different points, while the platform’s later accounting put stolen assets at approximately $295.7 million.\nNorth Korean hackers linked to April Drift exploit\nDrift said in its June 3 recovery update that cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Mandiant’s assessment cited operational evidence and similarities with other attacks linked to North Korean operators.\nThe attackers had spent months developing relationships with Drift contributors before acquiring the approvals needed to move assets, according to accounts published after the exploit. Investigators described a compromise of operational access and transaction authorization, not simply an error in a trading smart contract.\nDrift subsequently reorganized its recovery effort around a planned return to trading. In its June update, the platform said it had hired former Helium engineering executive Noah Prince to oversee protocol development and engaged former Gauntlet team members to review risk controls and liquidation infrastructure.\nThat work formed part of preparations for a relaunched trading platform intended to contribute revenue toward user compensation.\nDrift opens DFX recovery claims with initial pool of $3.1 million\nOn October 1, Drift opened claims and redemptions for DFX, a Solana token allocated to affected users according to their verified losses. The recovery framework assigns one DFX for each USDT of recognized loss and fixes total supply at 299,500,810.998 tokens.\nAt launch, the recovery pool contained around 3.1 million USDT. The stated initial redemption rate was approximately 0.0104 USDT per DFX, equivalent to roughly one cent for each dollar of eligible losses. Claiming a token is separate from receiving its full face amount in cash.\nUnder Drift’s published recovery rules, a holder can redeem DFX for an available share of the pool, sell the token on a secondary market or retain it as additional funding accumulates. Tokens redeemed against the pool are burned, reducing the outstanding supply.\nA portion of the relaunched platform’s net protocol revenue is directed to the pool each day. Drift lists contributions of 60% on the first 30,000 USDT of daily net revenue, 70% on the next band through 100,000 USDT and 90% above that threshold.\nDrift says any assets recovered through freezes, law enforcement or other recovery measures will be deposited in the pool. Tether has committed up to 127.5 million USDT in support, while other partners have committed up to 20 million USDT; those commitments should not be confused with money already available for immediate redemption.\nEligible users must submit their DFX claims before 00:00 UTC on January 1, 2028. Under the recovery terms, any tokens still unclaimed at that deadline will be permanently burned.\n\n\n\n\n\n                Read more:\n            \n\n                France proposes holding crypto platforms liable for DeFi security failures","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.0","shortVersion":"4.52.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2677676761","isCrawlerRequest":true}