Quick answer: On Oct. 20, 2026, the Drift exploiter sent about 25,700 ETH (roughly $61 million) to Tornado Cash over two hours, per Lookonchain and Cointelegraph. It still holds about 81,900 ETH, worth near $200 million at CoinGecko’s 16:58 UTC price of $2,450.
The Drift exploiter is using Tornado Cash again. On Oct. 20, 2026, the wallet behind the $295.7 million Drift Protocol hack pushed about 25,700 ETH into Tornado Cash in two hours, and it still holds close to $200 million in ether.
What happened in the Drift exploiter Tornado Cash move
On-chain tracker Lookonchain flagged the deposits on Tuesday. It said the exploiter had been inactive for two months. Then it sent 25,700 ETH, worth $61.56 million, to the mixer. After that, the wallet still held 81,864 ETH, or about $195 million at the time.
Cointelegraph reported the same 25,700 ETH figure. It cited Arkham data showing 81,454 ETH, roughly $194 million, left in the exploiter’s addresses. Security firm MistTrack put the mixed amount at 25,710 ETH, according to Blockchain.News.
However, not every tally matches. For example, TokenPost counted “at least 13,400 ETH,” about $32 million, in an earlier snapshot. The Defiant put the move at $54.8 million. The gap comes from timing and from which wallets each tracker follows. So, for now, treat 25,700 ETH as the latest figure, not a final one.
A quick recap of the April 1 Drift hack
Drift was the largest perpetual futures exchange on Solana. On April 1, an attacker took over its Security Council admin powers. Drift said at the time that the cause was not a smart contract bug. Instead, the attacker used pre-signed “durable nonce” transactions and social engineering to win 2-of-5 multisig approvals.
TRM Labs says the attacker then listed a fake token, CarbonVote (CVT), as collateral. Before that, it had faked a price near $1 for weeks through wash trading. Then, with withdrawal limits removed, 31 withdrawals drained the protocol in about 12 minutes. Most of the funds were bridged to Ethereum within hours.
Drift’s own breakdown lists $295.7 million in stolen assets, led by $159.3 million of JLP and $71.4 million of USDC. In June, Drift said a Mandiant probe linked the attack to UNC6862, a North Korean group, per Cointelegraph. DefiLlama ranks it as 2026’s third-largest crypto hack.
Why the Drift exploiter Tornado Cash deposits matter
First, the move points to a cash-out. Mixers pool deposits from many users. As a result, that breaks the link between the stolen coins and their next stop. North Korea-linked groups often mix funds, then sell through over-the-counter brokers or cross-chain swaps. In other words, a mixer deposit is usually step one, not the end.
Second, the haul is still huge. By our math, the remaining 81,864 ETH is worth about $200.6 million at CoinGecko’s price of $2,450.50 (Oct. 20, 2026, 16:58 UTC). That is about 68% of the original $295.7 million loss, still sitting in wallets anyone can watch.
Third, this is a pattern. For instance, TokenPost notes that linked wallets sent about $44.4 million in ETH to Tornado Cash in late July. Today’s round is larger. It also moved close to a quarter of the ETH the exploiter held this morning, by our count.
Data check: did it move the ETH price?
No, at least not yet. Ether traded at $2,450.50 at 16:58 UTC, up 2.1% in 24 hours, per CoinGecko. Its 24-hour trading volume was about $10.9 billion. So 25,700 ETH equals roughly 0.6% of one day’s volume.
Also, mixing is not selling. The ETH that went into Tornado Cash has not hit an exchange in any way trackers can see. That is why the market shrugged. Even so, a sudden sale of the remaining 81,000+ ETH would be a different story, so traders will keep watching.
What victims can expect from the recovery plan
Drift relaunched its exchange as Velocity and opened claims for DFX recovery tokens on Oct. 1. Each DFX equals one verified USDT of loss, with a fixed supply of 299.5 million, per Drift’s DFX update. The recovery pool held about 3.1 million USDT at launch.
By our calculation, that works out to roughly $0.01 per DFX for now. In addition, each day at 00:00 UTC, a share of Velocity’s revenue flows into the pool. Tether has committed up to 127.5 million USDT and other partners up to 20 million USDT. However, recovered ETH is the wild card. Once coins pass through a mixer, the odds of a freeze drop sharply.
What to watch next
- More mixer rounds. About 81,000 to 82,000 ETH remains. Further deposits would extend the pattern.
- Exchange inflows. Any transfer from mixer outputs to a major exchange could trigger freezes or a fast sale.
- Recovery pool growth. The DFX redemption value rises only as Velocity earns fees or funds come back.
- Security fallout. The Drift attack used approvals, not code bugs. Expect more DeFi teams to add timelocks to admin keys.
For context on how 2026’s losses stack up, see our look at Q3’s $1.18B in crypto hacks and the recent Cysic bridge exploit. Our DeFi risks guide explains admin-key risk in plain words.
Drift exploiter Tornado Cash FAQ
How much ETH did the Drift exploiter send to Tornado Cash?
About 25,700 ETH, worth roughly $61.6 million, over two hours on Oct. 20, 2026, according to Lookonchain and Cointelegraph. MistTrack counted 25,710 ETH, while earlier partial tallies were lower.
How much does the Drift hacker still hold?
Lookonchain reported 81,864 ETH left after the deposits, and Arkham data cited by Cointelegraph showed 81,454 ETH. At $2,450.50 per ETH (CoinGecko, Oct. 20, 2026, 16:58 UTC), that is close to $200 million.
Can Drift users get their money back?
Partly, over time. Affected users hold DFX tokens that claim a recovery pool funded by Velocity revenue, partner capital and any recovered funds. The pool held about 3.1 million USDT against 299.5 million DFX at its Oct. 1 launch.
Sources
- Lookonchain: Drift Protocol exploiter moves $61.56M in ETH to Tornado Cash
- Cointelegraph: Drift exploiter sends $61M ETH to Tornado Cash, holds $194M
- TokenPost: Wallets linked to Drift attack send about $32 million in Ether to Tornado Cash
- The Defiant: Drift-linked wallet sends $54.8 million in ETH to Tornado Cash
- Blockchain.News: MistTrack says Drift exploiter mixes 25,710 ETH
- Drift: Incident recovery update, April 16, 2026
- Drift: DFX claims and redemptions are now open
- TRM Labs: North Korean hackers attack Drift Protocol
- CoinGecko: Ethereum price
This article is for information only and is not financial advice. Crypto assets are volatile; do your own research before you invest.
