$61M of Drift Money Went to the Mixer; the Other $194M Stayed Home
25,710 ETH went into the mixer on October 20. Another 81,454 ETH stayed in the wallet.
The exploiter’s wallet sent 25,710 ETH, worth $61.24 million, to Tornado Cash on October 20, 2026[1]. Roughly 25,700 ETH of it entered within two hours[2].
On-chain analyst Yu Jin tracked the wallet. Mandiant’s forensic review tied the April attack on Drift Protocol to UNC6862, a North Korean threat group[3]. The stolen assets were swapped for 131,564 ETH at an average of $2,154 in April, and 24,400 ETH crossed Tornado in July[4].
The balance is still there — 81,454 ETH, worth $194 million, in no hurry[5].
What to do: nothing to revoke. The ETH in the transfer is the attacker’s; no holder approval appears in the path[1].
Who gains, who loses
Receipts
The Drift Protocol exploiter transferred 25,710 ETH worth $61.24 million through Tornado Cash, and the address still holds 81,454 ETH worth $194 million, according to on-chain analyst Yu Jin.
“According to on-chain analyst Yu Jin's monitoring, the hacker who stole $285 million in assets from Drift Protocol at the beginning of April transferred 25,710 ETH, worth $61.24 million, through Tornado 3 hours ago.”
Blockchain monitoring identified roughly 25,700 ETH moving into Tornado Cash within two hours on Tuesday, involving wallets associated with the April attack on Drift Protocol.
“Blockchain monitoring identified roughly 25,700 ETH moving into Tornado Cash within two hours on Tuesday.”
A forensic investigation by cybersecurity firm Mandiant attributed the Drift Protocol attack to UNC6862, a North Korean threat group.
“A forensic investigation conducted by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.”
The Drift Protocol attacker had exchanged the stolen assets for 131,564 ETH at an average price of $2,154 in early April and transferred 24,400 ETH through Tornado in July before the October 20 movement.
“The hacker had exchanged the stolen assets for 131,564 ETH at an average price of $2,154 in early April, and transferred 24,400 ETH through Tornado in July; the current address still holds 81,454 ETH, worth $194 million.”
The Drift Protocol attacker still controls approximately 81,454 ETH valued at $194 million after the October 20 Tornado Cash transfers.
“Blockchain tracking data indicates that the attacker still controls approximately 81,454 ETH, valued at $194 million.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.