Drift's Hacker Ran $61M Through Tornado Cash in Two Hours. Seven Months In, Only $9.2M of the $295M Has Been Frozen

Two hours. That’s how long it took a wallet tied to the Drift Protocol hack to push about $61.5 million in ETH into Tornado Cash on Tuesday.

Seven months. That’s how long investigators have had to freeze the rest. Total frozen so far: about $9.2 million.

And the people who actually lost money? Their recovery pool opened on October 1 with roughly $3.1 million in it, against a $295.4 million hole.

---

What Happened

On October 20, 2026, on-chain tracker Lookonchain flagged a Drift exploiter wallet depositing about 25,700 ETH (around $61.56 million) into Tornado Cash in about two hours. The funds had been sitting still for roughly two months.

Other trackers came in lower because they watched different address sets and time windows. Salus counted 19,600 ETH (~$46.8M) across 196 transactions, and Onchain Lens flagged 13,400 ETH (~$32M) from an address labeled “Drift Exploiter 5.” Every tracker agrees on the main point: a big new batch of stolen funds is going through the mixer.

It’s also not the first batch. About 23,100 ETH already went through Tornado Cash in July.

And there’s a lot left. Arkham Intelligence puts the remaining exploiter balance at about 81,454 ETH, roughly $194 million. Lookonchain’s count is a bit higher, at 81,864 ETH ($195M).

---

Quick Refresher: The $295M Drift Hack

We covered the hack as it happened on April 1. Early reports put the loss at $270M–$285M. The Drift Foundation’s own recovery report has since put it at about $295.4 million, which is the figure we use here.

• Target: Drift Protocol, Solana’s largest perpetuals DEX
• Time to drain: about 12 minutes
• How: a roughly six-month social-engineering operation. The attackers posed as a legit trading firm, built relationships at conferences and deposited real capital, then used compromised admin permissions
• Who: North Korea–linked. Mandiant, which Drift brought in, attributes it to a group it tracks as UNC6862. TRM Labs and Chainalysis point to UNC4736 (Citrine Sleet). Per CryptoTicker, no authority has published a conclusive finding

The stolen funds were bridged off Solana and turned into ETH. That’s why the laundering is happening on Ethereum, through Tornado Cash.

---

The Numbers That Should Bother You

	Amount
Stolen (April 1)	~$295.4M
Laundered through Tornado Cash on Oct 20 alone	~$61.5M (Lookonchain)
Still held by exploiter wallets	~$194M (Arkham)
Frozen by law enforcement	~$9.2M (~3%)
DFX recovery pool at launch (Oct 1)	~$3.1M (~1% of losses)

Drift’s recovery effort is real. Mandiant, zeroShadow and SEAL 911 have been tracing funds, a 10% bounty on recovered assets was posted jointly with Bybit, and DFX recovery tokens went live October 1. But the Foundation says frozen funds only come back through law enforcement, and that takes time.

Meanwhile, the attacker launders about $61M on a single Tuesday. Around $194M is still sitting in wallets that everyone can watch and no one can touch, so Tuesday probably wasn’t the last batch.

---

Why This Matters for Crypto Jobs

Blockchain forensics is the job that keeps making the news. Lookonchain, Arkham, Salus, Onchain Lens, TRM and Chainalysis are the reason anyone knows this happened, and their numbers are the ones getting quoted. Investigators who can cluster addresses, trace flows across bridges and get a public alert out fast are some of the most visible people in crypto right now.

Incident response doesn’t end when the drain stops. Seven months on, Drift still has people running tracing, bounty negotiations, exchange freeze requests and a recovery-token program. Protocols are learning they need recovery, legal liaison and victim-communications roles after a hack, not only auditors before one.

The real attack surface was people. Drift wasn’t beaten by a clever smart-contract bug. It was a six-month con aimed at people with admin access. Security hires who understand operational security, key management and social engineering, including the work of vetting counterparties and new hires, are worth more than another audit report. North Korea’s playbook depends on teams that don’t have them.

Compliance and AML teams get a fresh case study. Every exchange and off-ramp is now watching for Tornado Cash outputs tied to this wallet set. Transaction monitoring and sanctions-screening roles exist to catch exactly this.

---

The Bottom Line

Seven months after the biggest Solana hack since Wormhole, the attacker is still laundering on their own schedule. About $194M is waiting, roughly 3% is frozen, and the victims’ pool started at about 1 cent on the dollar.

Everyone can watch the money move. So far, almost nobody can stop it.

---

Want to be the one tracing the next $61M instead of reading about it? Security, forensics and compliance teams are hiring. Browse open roles on Cryptogrind →