Drift-Linked Wallets Reportedly Send $61.6 Million in ETH to Tornado Cash
Wallets that blockchain trackers link to the $285 million Drift Protocol exploit reportedly resumed moving ETH on October 20, 2026, sending funds to Tornado Cash after about two months of reported inactivity. The trackers differ on how much moved and how much remains. Their figures have not been reconciled into a verified accounting.
- Lookonchain reported 25, 700 ETH deposited, worth about $61.56 million.
- Onchain Lens reported at least 13, 400 ETH moved and gave a different estimate of the remaining assets.
- The April 1, 2026, attack involved social engineering and compromised protocol approvals, according to Chainalysis’s reconstruction.
- Drift’s DFX tokens represent claims on a recovery pool, not guaranteed dollar-for-dollar repayment.
Tracker estimates tell different stories
Lookonchain reported that 25, 700 ETH, worth about $61.56 million, entered Tornado Cash over two hours on October 20. It estimated that the associated wallets still held 81, 864 ETH, then worth about $195 million.
Onchain Lens reported that at least 13, 400 ETH, worth roughly $32 million, had been sent to Tornado Cash. Its separate snapshot put the remaining assets at about $224.59 million.
The estimates may cover different addresses or time windows, and the reports do not say whether they overlap. They should not be added together. The dollar valuations are approximate, and the trackers do not provide a shared price timestamp or valuation basis. Wallet balances are estimates, not a verified inventory of all assets controlled by the suspected attackers.
Tornado Cash pools deposits and lets users withdraw through separate addresses, making incoming and outgoing transfers harder to link. A deposit does not prove that the funds were sold, cashed out or made impossible to trace. What happened to the reported ETH afterward remains unknown.
How the Drift attack worked
Drift was attacked on April 1, 2026. Chainalysis estimated that the incident drained $285 million from the Solana-based derivatives protocol.
Chainalysis based its account of the attack on Drift’s investigation and said the account had not been independently verified when its report was published. It describes a months-long social-engineering operation in which the alleged attackers posed as representatives of a quantitative trading firm and built relationships with Drift contributors.
According to Chainalysis, the attackers obtained valid transaction approvals from members of Drift’s Security Council. They used Solana’s durable nonce feature to execute transactions that had been signed in advance. A durable nonce lets a pre-signed transaction remain valid until it is executed. Its use in this attack does not, by itself, show that Solana’s consensus mechanism has a flaw.
After gaining administrative control, the attackers reportedly approved CarbonVote Token (CVT), a fake token, as collateral. Chainalysis says they controlled around 80% of CVT’s supply, created a trading pool with roughly $500 in real liquidity and generated artificial trading activity to make the token appear to be worth about $1. They then used an attacker-controlled price oracle and changes to protocol settings to make the collateral look valuable enough to withdraw genuine assets.
The account points to a failure involving social engineering, signer approvals and control over protocol settings, rather than a blockchain feature simply behaving as designed.
Drift later said Mandiant attributed the attack to UNC6862, a North Korean threat group. That is Drift’s account of Mandiant’s conclusion. In its April report, Chainalysis described a possible North Korea link as unconfirmed.
DFX offers a route to recovery, not a fixed refund
Drift opened claims for DFX recovery tokens on October 1. Affected users receive one DFX for each verified USDT of loss. Drift set the token supply at 299, 500, 810.998 DFX.
The one-to-one allocation records the size of a verified claim. It does not promise immediate repayment of one USDT for each DFX. Drift says the redemption amount is calculated by dividing the recovery pool balance by the outstanding DFX supply. Holders can redeem tokens against available funds, keep them or trade them. DFX is transferable, so a later holder can redeem it, but its market price may differ from its redemption value.
Drift says the pool will receive funds from a share of net revenue generated by its relaunched trading platform, Velocity, along with money recovered through freezes, enforcement or other efforts. The platform’s stated support includes up to 127.5 million USDT from Tether and up to 20 million USDT from other partners. Those are commitment ceilings, not proof that the full amounts have been deposited into the pool.
Drift says varying shares of Velocity’s net protocol revenue will go toward recovery. The contribution is based on net protocol revenue, not simply gross trading fees. The pool’s eventual size, and the amount each DFX holder can redeem, depend on the funds actually received and the number of tokens still outstanding.
Claims remain open until 00:00 UTC on January 1, 2028. Drift says unclaimed DFX will then be burned. Neither the final recovery amount nor the timing of any payout is guaranteed.
Key questions and answers
-
How much ETH reportedly went to Tornado Cash?
Lookonchain reported 25, 700 ETH, while Onchain Lens reported at least 13, 400 ETH. The figures may overlap or cover different addresses and time windows, so they cannot be combined into a reliable total.
-
Does the transfer mean the ETH was cashed out?
No. The reported deposits make direct tracing harder, but they do not show what happened to the funds afterward.
-
How did attackers reportedly exploit Drift?
According to Chainalysis’s account, they used social engineering to obtain transaction approvals, gained administrative control and manipulated the apparent value of a fake collateral token to withdraw genuine assets.
-
Does one DFX guarantee one USDT in repayment?
No. Drift allocates one DFX per verified USDT of loss, but redemption depends on the recovery pool’s balance and the outstanding DFX supply.
For context on the legal debate around Tornado Cash developers, the Ethereum community has demanded their release amid legal battles.
