Drift hacker pushes $61 million of ether into Tornado Cash after two quiet months, and still holds about $194 million

The attacker behind one of the year's biggest crypto thefts is on the move again. Wallets linked to the April 1 exploit of Drift, a decentralized exchange on Solana, deposited 25,700 ether, about $61 million, into Tornado Cash over about two hours on Tuesday, Decrypt and Cointelegraph reported. The addresses had been dormant for about two months. Cointelegraph said the blockchain tracker Lookonchain flagged the transfers.

It is the second large tranche into the mixer, which makes funds much harder to trace: an address labeled "Drift Exploiter 4" sent about 23,095 ether, then about $44.4 million, to the same mixer on July 23 and 24, per Decrypt. Arkham data shows the attacker's addresses still hold about 81,454 ether, roughly $194 million, Cointelegraph reported.

Drift has put its losses at about $295 million. It said in June that Mandiant had attributed the attack to UNC6862, a North Korean group, which Drift said had spent about six months posing as a trading firm. Cointelegraph said DefiLlama ranks it as 2026's third-largest crypto hack.

Victims are still waiting. Drift, which now operates as Velocity, opened claims on its DFX recovery token on October 1, when the pool held about $3.1 million, roughly a penny per dollar lost, per Decrypt and The Block. Decrypt said Tether has committed up to 127.5 million USDT toward the relaunch and recovery.