Most of the $295 million taken from Drift in April is not coming back soon, and the hacker is still moving it. A wallet tied to the April hack of Drift Protocol, a Solana trading platform that lost about $295 million, sent roughly 25,700 ether (about $61 million) into the Tornado Cash mixer on October 20, according to on-chain trackers Lookonchain and Arkham. It had sat untouched for about two months. Security firm Mandiant has linked the attack to a North Korean hacking group. Drift's victims are being repaid slowly through "recovery tokens".

Key facts

  • Who: The attacker behind the Drift Protocol hack, linked by Mandiant to a North Korean group
  • What: Sent about 25,700 ETH into Tornado Cash, a mixer that hides where coins go
  • When: October 20, 2026; the hack itself was on April 1, 2026
  • How much: About $61 million moved; about $295 million stolen in the original hack
  • Source: On-chain data from Lookonchain and Arkham, reported by Cointelegraph

What happened

Drift was hacked on April 1 after attackers tricked its administrators into approving fraudulent transactions, and it paused trading. Much of the stolen money has since been held as ether. A first batch of about 23,000 ETH went through Tornado Cash in late July. This week's move is the second big batch. One outlet counts about 44,500 ETH (about $109 million) sent over October 20 and 21, but most reports put the first day at about 25,700 ETH. Trackers say the attacker's wallets still hold a large amount of ether, with estimates ranging from about $138 million to $194 million.

Where victims stand

Drift chose to repay users with "recovery tokens", each worth $1 of verified loss. The pool is funded by Drift's remaining assets, future revenue and pledges from partners including Tether, so it will take years to fill. One report says the first payouts came to about 1 cent per dollar lost. Circle froze about $3.4 million in USDC, but most of the money is still with the attacker.

Lessons, and a warning

  • A trading platform can be emptied even when its code is sound, if attackers fool the people who hold the keys. Our due diligence checklist covers what to check before you deposit.
  • Drift victims will be targeted by fake "fund recovery" firms that claim they can trace the mixer and get money back for a fee. The FBI warns these are almost always a second scam.
  • Only trust claims made through Drift's official channels. Ignore DMs and "claim your refund" links.

If you were hit, the one thing to do this week is say no to anyone who contacts you first. Nobody can pull coins back out of a mixer for a fee, and the people who say they can are counting on you hoping they're right.

Sources: Cointelegraph, Crypto Briefing, crypto.news, Decrypt: Drift's repayment plan, DL News.