The short version
- Drift hacker wallets sent about 50,585 ETH ($122 million) into Tornado Cash on October 20 and 21, after two months of silence.
- The mixer hides where the ETH goes next, and Drift victims have so far got back about a penny per dollar lost.
- About 56,600 ETH ($136 million) is still waiting, roughly 1% of one day of ETH trading volume.
The Drift hacker went quiet for two months, then emptied a big slice of the loot into Tornado Cash in two mornings. Lookonchain counted 25,700 ETH ($61.56 million) on Tuesday and another 24,885 ETH ($61.3 million) on Wednesday. That is about $122 million gone into the mixer, and the wallets still hold roughly 56,600 ETH.
The money comes from the April 1 Drift exploit, a raid on the Solana perpetuals exchange that Drift has tied to North Korean hackers. So why launder it now, and does it mean anything for the people who lost funds, or for ETH?
Lookonchain flagged the first batch while it was still going in:
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.
Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).
arkm.com/explorer/entit…
How Does Tornado Cash Hide Stolen ETH?
Tornado Cash breaks the link between the wallet that pays in and the wallet that takes out. Users deposit fixed amounts, such as 10 or 100 ETH, into a shared pool and get a private note. Later, that note withdraws the same amount to a brand-new address.
Because every deposit in a pool looks the same, an outsider can’t tell which withdrawal belongs to which deposit. That is why the Drift hacker sent hundreds of identical 100 ETH chunks plus a few 10 ETH ones, as Decrypt reported from Arkham’s data. In other words, the more ETH that goes in at once, the bigger the crowd it hides in.
It isn’t a clean getaway, though. Analysts can still match deposit and withdrawal times and amounts, and exchanges block coins they can trace back to a known hack.
Why Did the Drift Hacker Wait Two Months?
Because laundering a nine-figure haul is slow work. The same wallets sent about 23,095 ETH ($44.4 million) to Tornado Cash on July 23 and 24, then sat still until this week. Hackers often move in waves like this, waiting for attention to fade before the next batch.
Drift said in June that a forensic review by Mandiant tied the attack to UNC6862, a North Korean threat group, Cointelegraph reported. The attack itself had no smart contract bug. The group spent about six months posing as a trading firm, met Drift contributors in person and deposited $1 million of its own money to build trust. Then it got admin powers, listed a fake token and borrowed out the real liquidity. Drift put the loss at $295.7 million.
DISCOVER: 10 Common Crypto Scams and How to Spot Them
What Can Drift Users Get Back?
Very little so far. Drift opened claims for its DFX recovery tokens on October 1, one token for every USDT of verified loss, about 299.5 million tokens in all. The recovery pool started with about 3.1 million USDT, so early redeemers got roughly a penny per dollar lost.
The pool takes 60% to 90% of daily revenue from Velocity, the relaunched exchange, and any stolen funds recovered later. Every ETH that comes out of Tornado Cash on the other side is one that will be much harder to freeze.
Ethereum Price Analysis: Does the Drift Hacker’s ETH Matter?
Not much. A mixer deposit isn’t a sale, and even if the remaining 56,600 ETH hit the market at once, it would be about $136 million. For context, ETH traded $12.42 billion in the last 24 hours, so that is around 1% of one day’s volume.
Ethereum (ETH USD) trades at $2,408.19 at the time of writing, down 1.15% over 24 hours and 12.80% over 30 days. It sits under its 50-day exponential moving average (EMA), a trend line that weights recent prices more, at $2,475.36, but above the 200-day EMA at $2,318.59.
- In the bull case, a daily close back above the 50-day EMA puts $2,546 in view.
- In the base case, ETH chops between $2,358 and $2,475 while the market waits for direction.
- In the bear case, losing the 200-day EMA opens the way to $2,310, the 0.382 Fibonacci level.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
EXPLORE: Ethereum ETF Outflows Pass $1 Billion in October as Bitcoin ETFs Pull In $1.07B in Three Days
The bigger lesson isn’t on the chart. Drift lost $295 million without a single line of buggy code, to people who shook hands with its team. Before you park funds in any protocol, check who can approve admin changes and how many signatures that takes.
On the climb since 2017. Trades futures and reads onchain data. Automates the boring parts.
More from VikingXBT →
