Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo

An Ethereum wallet linked to the April 1 exploit of crypto trading protocol Drift sent 25,710 $ETH into the Tornado Cash mixer on Oct. 20, nearly emptying the address in its first outgoing Ethereum transactions.

The address, which Etherscan labels “Drift Exploiter 5”, held about 3.98 $ETH on Oct. 20. On-chain analysis profile Lookonchain separately reported holdings of 81,864 $ETH across the exploiter wallets it tracks.

258 deposits in two hours and 13 minutes

The wallet made 258 successful deposits to the Tornado Cash router: 257 of 100 $ETH each, followed by a final deposit of 10 $ETH. Together, they moved 25,710 $ETH out of the address.

The first deposit was confirmed at 07:08:35 UTC in block 26,232,203. The last followed at 09:21:35 UTC in block 26,232,865, completing the sequence in 2 and 13 minutes.

The deposits were worth about $63.1 million, based on Ethereum's average price of $2,450 as of Oct. 20.

The movement came more than six months after the April 1 attack. In its April 2 disclosure through Velocity, Drift initially estimated that approximately $280 million had been withdrawn from the protocol.

Drift’s account of the attack described a takeover of its Security Council administrative powers. It said the attacker had used durable nonce accounts to pre-sign transactions and delay their execution, obtaining unauthorized or misrepresented transaction approvals in advance.

At that point, Drift said its investigation had not found a bug in its programs or smart contracts. Its update published June 4 said the Mandiant investigation it commissioned had attributed the attack to UNC6862, a North Korean threat group.

How recovered funds reach Drift users

Drift’s Recovery Pool is one way stolen assets could return to affected users. Drift says funds recovered through freezes, its bounty, or law enforcement go into the pool, alongside a share of the trading platform’s net protocol revenue.

Drift opened DFX claims and redemptions on Oct. 1, allocating one DFX for each $USDT of verified loss. A holder can redeem tokens for $USDT at the quoted redemption amount. The submitted DFX are burned in the same transaction.

One DFX per $USDT of loss records the size of a user’s claim. The $USDT paid out depends on the redemption quote at the time of exchange, linking cash recoveries to the funding that entered the pool.

Redeeming exchanges the submitted tokens’ participation in future pool deposits for the $USDT payout quoted at the time. A user who redeems only part of a holding keeps that participation for the DFX retained.

As of Oct. 4, the Oct. 1 quote was at about 0.0104 $USDT per DFX, close to one cent per $USDT lost.

Drift’s April 16 update proposed up to $127.5 million from Tether and $20 million from other partners. The package contemplated a revenue-linked credit facility, an ecosystem grant and market-maker loans.

The Oct. 20 deposits show where this wallet’s $ETH went, but how much stolen money ultimately returns to the recovery pool remains unresolved.