Wallets linked to the Drift exploit deposited 44,510 Ether, valued at roughly $109 million, into Tornado Cash on October 20–21, 2026, blockchain tracker Onchain Lens reported. The transfers moved previously stolen assets through the cryptocurrency mixer; they do not represent new user losses or confirmed ETH sales.
Key Takeaways
- The two-day transfers were equivalent to about 37% of Drift’s reported April attack losses.
- Arkham-labeled exploiter wallets reportedly still held 56,569 ETH, worth approximately $138 million.
- DFX compensation depends on assets reaching the recovery pool, not balances attributed to the attacker.
Table of Contents
- Drift exploit transfers expand mixing activity
- User compensation relies on a separate recovery pool
- Wallet balances are not available compensation
- Conclusion
Drift exploit transfers expand mixing activity
Onchain Lens reported deposits of approximately 25,710 ETH on October 20, followed by another 18,800 ETH, worth about $46 million, on October 21. The activity resumed after roughly two months of inactivity.
An address associated with the exploit had also sent 23,095 ETH to Tornado Cash in July. Together, the reported July and October deposits total approximately 67,605 ETH. Their dollar values at the respective transfer dates are not directly comparable because ETH prices changed.
Tornado Cash obscures the public connection between deposits and subsequent withdrawals, complicating efforts to trace funds. Using the mixer does not, by itself, establish that the assets have been sold, converted into cash or placed permanently beyond investigators’ reach.
| Item | Details |
|---|---|
| Fixed DFX supply | 299,500,810.998 tokens; no additional DFX can be minted. |
| Redemption calculation | Recovery pool balance divided by outstanding DFX supply. |
| Revenue funding schedule | Daily at 00:00 UTC. |
| Claim deadline | 00:00 UTC on January 1, 2028; unclaimed DFX will be burned. |
User compensation relies on a separate recovery pool
Drift reported approximately $295.4 million in user losses from the April 1, 2026 attack on its Solana-based decentralized exchange. Its investigation with cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. That is a forensic attribution, not a criminal conviction identifying the wallet operators.
Drift’s DFX claims and redemptions announcement opened the compensation process on October 1. Users receive one DFX for each verified USDT lost, and can burn the tokens for USDT from the recovery pool.
At launch, the pool held approximately 3.1 million USDT and offered about 0.0104 USDT per DFX—roughly one cent per dollar of verified loss. Those are launch figures, not a confirmed October 21 redemption value.
Drift Foundation previously disclosed that approximately $9.2 million in stolen assets had been frozen. Legal and law-enforcement procedures are required before their release, so frozen funds cannot yet be treated as compensation returned to users.
Wallet balances are not available compensation
The roughly $138 million in ETH reportedly remaining in attacker-linked wallets is a balance investigators can monitor, not money available for DFX redemptions.
Drift has also outlined commitments of up to 127.5 million USDT from Tether and up to 20 million USDT from strategic partners. These involve different funding arrangements and should not be counted as cash already in the recovery pool.
A separate funding channel is Velocity’s trading activity. Under the published mechanism, 60% to 90% of daily net protocol revenue flows into the pool, with each rate applying to its respective revenue band. Actual deposits, rather than commitments or tracked wallet values, determine the funds supporting redemptions.
Conclusion
The next scheduled recovery-pool funding occurs daily at 00:00 UTC. Confirmed deposits and any legally returned assets will provide firmer evidence of compensation progress than further movements between attacker-linked wallets.
Read More News
Disclaimer
This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.
