Hacker Behind Drift Protocol Attack Launders $61M Through Tornado Cash, Still Controls $194M
Following a devastating attack on April 1 that resulted in approximately $295 million in damages, cybersecurity researchers at Mandiant traced the breach to a North Korean hacking collective.
An address associated with the Drift Protocol security breach has transferred approximately $61 million worth of Ether (ETH) into Tornado Cash, a cryptocurrency mixing platform designed to hide the origin and destination of digital asset transactions.
According to blockchain analytics firm Lookonchain in a statement posted on X, the wallet moved 25,700 ETH into the mixing service during a two-hour period on Tuesday, marking the first activity from the address in two months.
Data from Arkham Intelligence indicates that addresses controlled by the attacker still possess approximately 81,454 Ether, valued at roughly $194 million. Cryptocurrency mixing services work by combining funds from numerous different addresses, effectively obscuring the transaction history and making it significantly more difficult for investigators to trace the movement of stolen assets.
The Drift Protocol, a decentralized trading platform built on the Solana blockchain, disclosed losses totaling approximately $295 million following the security breach that occurred on April 1. In a June announcement, Drift revealed that Mandiant, a leading cybersecurity research company, had conducted a comprehensive forensic analysis that identified the perpetrator as UNC6862, a cybercriminal organization with ties to North Korea.
On Oct. 1, Drift initiated a claims process and began distribution of DFX recovery tokens to impacted users. These specialized tokens entitle holders to a proportional share of a recovery fund, which contained approximately $3.1 million when it was established and continues to accumulate funds through platform trading fees and any assets successfully recovered from the attackers.
Based on data compiled by DefiLlama, the Drift Protocol security breach represents the third-largest cryptocurrency theft of 2026. The incident follows other significant exploits during the year, including a $387 million attack on Bitget and a $320 million compromise of the Liquid Network infrastructure.