Choose Rich Live
Crypto News

Drift Protocol exploiter sends $61M in Ether to Tornado Cash after two months of inactivity

The hacker behind the Drift Protocol breach transferred 25,700 ETH into the privacy mixer Tornado Cash over a two-hour span, ending two months of dormancy while still holding nearly $195 million in cryptocurrency.

On-chain transaction log showing repeated 100 ETH transfers from the Drift Protocol exploiter address to the Tornado Cash router
Image: @lookonchain

The exploiter linked to the Drift Protocol hack moved 25,700 Ether, worth approximately $61.56 million, into Tornado Cash across a two-hour window, according to on-chain analytics platform Lookonchain. The flurry of mixer transactions ended roughly two months of inactivity from the attacker's wallets.[1][2][3][4][5]

Transaction screenshots show the attacker funneling the stolen crypto through repeated 100 ETH deposits to the Tornado Cash router. Arkham tracking shared by Lookonchain indicates the exploiter still controls 81,864 ETH, valued at roughly $194.7 million to $195 million, spread across 71 addresses, with Decrypt reporting the attacker retains roughly $198 million in total assets.[2][3][4][5]

The exploit, which occurred on April 1, resulted in an estimated $295 million in losses, though initial assessments placed the figure above $270 million. A subsequent Mandiant investigation attributed the heist to a North Korean threat group. Following the theft, Drift rebranded to Velocity DEX as its development team works toward a relaunch centered on user recovery.[2][3][4][5][6]

Key facts

  • The Drift Protocol exploiter deposited 25,700 ETH ($61.56 million) into Tornado Cash over two hours after two months of inactivity, per Lookonchain.
  • On-chain logs show the exploiter made repeated 100 ETH deposits to the Tornado Cash router.
  • Arkham data shows the exploiter portfolio holds 81,864 ETH worth $194.72 million across 71 addresses, with total tracked holdings exceeding $195.28 million.
  • Decrypt reported that the attacker still controls roughly $198 million in remaining funds.
  • The April 1 exploit caused roughly $295 million in losses, though early estimates placed the stolen sum at over $270 million.
  • A Mandiant investigation attributed the April 1 breach to a North Korean threat group.
  • Drift Protocol has rebranded to Velocity DEX as it works toward a relaunch focused on user recovery.

Sources 路 6 sources

  1. CO

    CoinMarketCap@CoinMarketCapPost on X 路

    UPDATE: 馃毃 A wallet linked to the Drift Protocol exploit moved 25,700 ETH, about $61M, into Tornado Cash over two hours after two months of inactivity, per Lookonchain. https://t.co/HXuDc1aiSG

    Open source
  2. LO

    Lookonchain@lookonchainPost on X 路

    The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity. Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M). https://t.co/FRtFrS7rew https://t.co/9ISUIlkHvT

    Open source
  3. SO

    SolanaFloor@SolanaFloorPost on X 路

    NEWS: The exploiter behind the $270M+ DriftProtocol hack, now known as @VelocityDEX, has resumed moving funds after 2 months of inactivity. The attacker deposited 25,700 $ETH worth $61.56M into @TornadoCash over the past 2 hours and still holds 81,864 $ETH worth $195M. https://t.co/wd5OnTaFwx

    Open source
  4. DE

    DecryptArticle 路

    Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash The North Korea-linked attacker behind April's $295 million Drift heist pushed 25,700 ETH through the mixer in two hours, and still controls roughly $198 million more.

    Open source
  5. CB

    Crypto Banter@crypto_banterPost on X 路

    馃毃DRIFT EXPLOITER MOVES $61M ETH TO TORNADO CASH! The Drift Protocol exploiter, who stole over $270 million, has begun moving $ETH to Tornado Cash after two months of inactivity, per @lookonchain. Over the past two hours, the address deposited 25,700 ETH worth $61.56 million into the mixer and still holds 81,864 ETH valued at roughly $195 million. Drift has since rebranded to Velocity DEX as it rebuilds toward a relaunch focused on user recovery.

    Open source
  6. CT

    Coin TelegraphArticle 路

    Drift exploiter sends $61M ETH to Tornado Cash, holds $194M The April 1 hack caused about $295 million in losses and was later attributed to a North Korean threat group in a Mandiant investigation.

    Open source