On October 20, 2026, wallet addresses associated with the attack on the derivatives exchange Drift Protocol earlier in the year suddenly reactivated, transferring a total of 25,700 ETH, worth approximately $61.56 million, to the cryptocurrency mixing protocol Tornado Cash.

The transfers took place in rapid succession after roughly two months of complete inactivity across this cluster of wallets, indicating that the attackers are continuing the process of laundering their illicit funds.

On-Chain Flow and the Massive Remaining Assets

According to real-time tracking data from analytics platform Arkham Intelligence, the entire 25,700 ETH was deposited into Tornado Cash over a span of about two hours. The attacker broke down the funds into standardized deposits matching the mixer’s liquidity pools, primarily batches of 100 ETH (worth around $237,800 per transaction) alongside several smaller 10 ETH deposits. By sending funds into these fixed pools, depositors can withdraw them from entirely fresh wallet addresses to sever the public link on the blockchain ledger.

This marks the second large-scale asset liquidation event in the incident. Previously, on July 23 and July 24, 2026, a wallet labeled Drift Exploiter 4 had also transferred 23,095 ETH (worth approximately $44.4 million at the time) into the same mixing protocol.

Despite moving more than $105 million across two waves, the cluster of 71 wallet addresses monitored by Arkham still holds up to 81,454 ETH, equivalent to a market value of around $198.58 million. In addition to this massive amount of Ether, the wallet cluster also retains approximately $561,600 in other cryptocurrencies, including USDT, USDC, Solana, and USDY.

A Sophisticated Infiltration Scenario and Slow Repayment Reality

The exploit targeting Drift Protocol on the Solana network occurred on April 1, 2026, with total losses determined to reach $295.7 million. The attacker compromised internal governance permissions, introduced a counterfeit token, and used it as collateral to borrow and drain the exchange’s authentic liquidity. The drained assets primarily consisted of $159.3 million in Jupiter Liquidity Provider (JLP) tokens and $71.4 million in the USDC stablecoin, most of which was subsequently swapped for Ether and bridged to the Ethereum network.

According to an investigative report published in June 2026 by cybersecurity firm Mandiant, the attack was a six-month campaign carried out by the hacking group UNC6862, which is believed to have ties to North Korea. The group posed as a quantitative investment fund, met in person with project members, and even deposited $1 million in real funds into the platform to build trust before executing the attack.

In stark contrast to the hackers’ laundering speed, the compensation process for victims remains extremely sluggish. The Drift platform, which has since restructured and rebranded as Velocity exchange, opened a claims portal for DFX compensation tokens on October 1, 2026, at a rate of 1 DFX for every 1 USDT of recognized losses, corresponding to roughly 299.5 million tokens. However, the recovery liquidity pool held a mere 3.1 million USDT at launch. Users requesting early redemptions received only about 0.0104 USDT per DFX token, amounting to just about 1 cent for each USD lost.

The recovery fund is expected to be gradually replenished by allocating 60% to 90% of Velocity’s daily net revenue, alongside a support commitment of up to 127.5 million USDT from Tether. Nonetheless, with nearly $200 million in assets still in the hands of the attackers and progressively disappearing into mixing protocols, the chances of victims fully recovering their lost funds remain a distant prospect.