Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash

What it is

Drift Protocol, a Solana exchange, lost $295.7 million on April 1, 2026. Mandiant attributed the attack in June 2026 to UNC6862, a North Korean threat group, according to Drift. This Decrypt article adds how the attack worked, what was stolen, and how the laundering and recovery have gone since.

How it works

Drift says the attack was a six-month operation. The group posed as a quantitative trading firm, met Drift contributors in person, and deposited $1 million of its own money to build trust.

On Solana, the attacker then gained admin powers over Drift's vaults. They introduced a fake token and used it to borrow out real liquidity.

Drift's asset breakdown lists $159.3 million in JLP (the Jupiter Liquidity Provider token), $71.4 million in USDC, and $4.1 million in Fartcoin. Most of the USDC was later swapped and bridged to Ethereum.

Laundering trail

• Arkham Intelligence tracks 71 attacker addresses. Before the latest deposits they held a large ETH balance, and 81,454 ETH (about $198.58 million) remains, plus about $561.6K in USDT, USDC, Solana and USDY.
• On July 23 and 24, an address labeled Drift Exploiter 4 sent about 23,095 ETH (about $44.4 million then) into Tornado Cash.
• The latest burst was 25,700 ETH (about $61.56 million) over about two hours, after roughly two months of inactivity. Deposits were 100 ETH batches (about $237,800 each) plus 10 ETH chunks, matching Tornado Cash's fixed pools.

What to do

The page gives no remediation steps. For monitoring, it shows that the attacker's addresses are labeled on Arkham and that the funds are still mostly unmixed. Tornado Cash deposits in fixed 100 ETH and 10 ETH sizes from these addresses are the observable pattern.

Recovery terms

Drift's DFX recovery token opened claims on Oct. 1, 2026, at one token per USDT of verified loss (about 299.5 million tokens). The pool held about 3.1 million USDT at launch, so early redemptions paid about 0.0104 USDT per token. The pool receives 60% to 90% of net protocol revenue from Velocity, the relaunched exchange, with the share rising as daily revenue grows. Tether has committed up to 127.5 million USDT. Funds recovered through freezes, the bounty or law enforcement also go into the pool.

Caveats

The attribution to UNC6862 and the six-month account come from Drift's statements, not independent confirmation. The page does not say how the admin access was obtained beyond the in-person trust-building, and it gives no technical detail on the fake token.