A wallet cluster linked to the April Drift hack just sent 25,700 ETH (about $61.6 million) into Tornado Cash in a two-hour burst. Arkham still shows 81,454 ETH left with the attacker. This quick guide explains the latest Drift exploit Tornado Cash deposits 2026, what remains on-chain, and how anyone can track the funds step by step.

Drift exploit Tornado Cash deposits 2026: What just moved?

The new transfers

On Tuesday, addresses tied to the April 1 Drift Protocol exploit sent 25,700 ETH to Tornado Cash. The deposits arrived mostly in 100 ETH batches, with some 10 ETH entries. Those sizes match Tornado Cash’s fixed pools. The goal is to sever the public link between the sending and receiving addresses. The wallets had been quiet for about two months. This push follows a July 23–24 series when a labeled address (Drift Exploiter 4) moved roughly 23,095 ETH into the same mixer. Tornado Cash is a sanctioned service in many places, including the U.S. Using it can carry legal, compliance, and operational risks. This article focuses on public, on-chain facts and tracking methods for transparency and safety.

What remains on-chain

Arkham Intelligence tracks 71 addresses tied to the attacker. After the new mixer deposits, those addresses still hold 81,454 ETH. At current prices, that is about $198 million. The portfolio view also shows smaller balances in USDT, USDC, Solana, and USDY. Oddly, it lists one Fartcoin, worth only cents, far less than the millions in Fartcoin reportedly taken during the exploit.

How the hack worked, in brief

From admin powers to drained vaults

The April 1 attack struck Drift on Solana. The attacker gained admin powers, introduced a fake asset, and used it as collateral to borrow out real liquidity from Drift’s vaults. Drift’s postmortem puts the total loss near $295.7 million. The biggest buckets were:

• About $159.3 million in JLP (the Jupiter Liquidity Provider token)
• About $71.4 million in USDC
• Other assets that were later swapped and bridged to Ethereum

Attribution and tradecraft

Drift said the operation ran for six months. The group posed as a quant firm, met contributors in person, and even deposited $1 million to gain trust. In June, forensic firm Mandiant attributed the attack to a North Korean threat group labeled UNC6862. The careful social engineering matches the long timeline and the methodical on-chain moves that followed.

Where recovery stands today

DFX token claims and initial redemptions

After the attack, Drift relaunched its exchange as Velocity. On October 1, the team opened claims for the DFX recovery token at a 1:1 rate versus verified USDT losses. About 299.5 million DFX were issued. The pool held around 3.1 million USDT when it opened. That meant early redeemers received about 0.0104 USDT per DFX—roughly one cent on the dollar.

Ongoing funding and revenue share

Drift says the recovery pool receives a daily cut of Velocity’s net protocol revenue. The share ranges from 60% to 90%, scaling with revenue. Tether has also committed up to 127.5 million USDT toward the relaunch and recovery plan. Any funds frozen, clawed back through bounties, or recovered by law enforcement flow into the same pool. As volumes grow, the pool could improve redemption rates over time. But the pace depends on market activity and the chance of meaningful asset recovery.

How to track the funds in practice

Start with labels and entity pages

Begin with an intelligence dashboard. Arkham’s entity page for the attacker bundles 71 addresses. Label hubs save time and help you avoid obvious decoys.

• Open the attacker’s entity page on Arkham or a similar tool.
• Export the address list and set portfolio alerts where possible.
• Cross-check the set on Etherscan using Watchlists and Notes.

This is where the latest Drift exploit Tornado Cash deposits 2026 become visible in one place. You can see the 100 ETH and 10 ETH patterns, plus the timing of each send.

Follow the bridge and swap footprints

The funds left Solana after the attack, then moved to Ethereum. To trace this:

• Review Solana-to-Ethereum bridge contracts (e.g., Wormhole) during the original post-exploit window.
• Match bridge outputs to fresh Ethereum addresses and check the first swaps (often to liquid pairs like ETH/USDC).
• Use transaction comments, MEV bot tags, and DEX analytics to confirm asset routes.

Bridging often creates clean graph lines. Focus on the time window when the attacker moved size. You can then jump into Ethereum and continue from the first-hop addresses.

Spot mixer behavior and heuristics

Tornado Cash deposits in fixed sizes are a tell. Watch for:

• 100 ETH and 10 ETH deposits from related addresses in tight time windows
• Evenly spaced deposit intervals to avoid spiking gas
• Subsequent withdrawals to new addresses with no prior history

Heuristics can help:

• Timing correlations: withdrawals often arrive hours or days after batches of deposits.
• Gas and nonce patterns: similar fee choices or nonce pacing can hint at shared control.
• Dust links: tiny test sends may connect a new address to a known cluster.

Note: Heuristics can produce false positives. Always keep a confidence score and show your evidence chain.

Watch the exit ramps

Attackers eventually try to turn crypto into spendable value. Key exit routes include:

• Centralized exchanges (CEX): Often via front wallets. Look for KYC-linked flags or compliance freezes.
• Cross-chain swaps and bridges: Moving to faster or cheaper chains before cash-out.
• OTC desks or P2P venues: Harder to see, but inflows to OTC-known wallets sometimes leave clues.

Set alerts on:

• Known exchange deposit addresses and hot-wallet clusters
• High-liquidity router contracts (e.g., 1inch, Uniswap routers)
• Bridges with large daily flows

Automate and document

Use alerts and scripts to avoid manual gaps.

• Subscribe to push alerts for large sends from the 71-address cluster.
• Tag each new address the moment it touches a known attacker wallet.
• Record a simple chain of custody for each hop so others can audit your trail.

This workflow makes the next wave of Drift exploit Tornado Cash deposits 2026 much easier to catch in real time. It also improves collaboration with exchanges, analytics firms, and investigators.

Why these moves matter for markets

Liquidity, price pressure, and risk

Large mixer deposits signal potential selling at some point. They may not cause an immediate dump, but they raise tail risk. Traders watch for:

• Fresh ETH outflows from Tornado to new addresses that hit DEX routers
• Unusual sell pressure during thin liquidity windows
• Cross-chain moves that reduce slippage and mask exits

On the other hand, disciplined tracking, exchange freezes, and better compliance tooling can slow the attacker’s options. That can reduce near-term market shock.

Compliance and enforcement

The sanctions status of Tornado Cash raises the stakes for any party that touches these flows. Exchanges and service providers that monitor the 71-address cluster—and the fresh addresses birthed by withdrawals—can cut off exits. That helps route more recovered value back to victims, which can also support DFX redemption over time.

Key takeaways and next steps

• 25,700 ETH hit Tornado Cash in a tight two-hour window, mostly in 100 ETH batches.
• About 81,454 ETH remains on-chain with the attacker’s tracked wallets.
• The exploit drained roughly $295.7 million across assets, much of it bridged to Ethereum.
• DFX redemptions started near one cent on the dollar; future pool inflows depend on Velocity revenue and recoveries.
• Any new Drift exploit Tornado Cash deposits 2026 should be tracked with labels, alerts, and careful heuristics to spot exits.

The funds keep moving, and the window to block exits can be short. Keep alerts on the labeled entity, watch for fresh addresses birthed by Tornado withdrawals, and log every hop. With steady tracking and strong exchange controls, more value can be trapped before it reaches the cash-out point. The attacker’s latest wave shows the playbook is still active. Stay focused on the fixed-size deposit patterns, cross-chain routes, and router interactions. If another round of Drift exploit Tornado Cash deposits 2026 starts, you will be ready to trace it, flag it, and help protect liquidity and users.

(Source: https://decrypt.co/381450/wallet-drift-exploit-sends-61-million-ethereum-tornado-cash)

For more news: Click Here

FAQ