North Korea-linked attacker from April's $295M Drift exploit launders $61M in ETH through Tornado Cash, still holding ~$198M in stolen funds.
Security & Exploits ·
Addresses connected to the April Drift Protocol breach moved 25,700 ETH (approximately $61.56 million) into Tornado Cash on Tuesday, completing the transfers within two hours. The funds flowed through the privacy mixer in batches matching its fixed deposit sizes, enabling the attacker to obscure the on-chain connection between source and destination. Arkham Intelligence tracking data indicates the attacker's 71 monitored wallets retain roughly 81,454 ETH worth near $198 million following this second wave of mixing activity.
The initial breach at Drift, which occurred April 1 and netted $295 million total, involved the attacker obtaining administrative access, deploying a counterfeit token, and leveraging it to extract legitimate liquidity from protocol vaults on Solana. Law enforcement and forensic analysis later linked the operation to UNC6862, a North Korean threat group, which had reportedly spent six months embedded within Drift's operations under the guise of a trading firm. A prior mixing event involving approximately 23,095 ETH took place in late July.
The protocol's recovery mechanism launched October 1 through Drift's rebranded exchange, Velocity, distributing DFX tokens to verified loss holders at a 1:1 ratio against USDT losses. The initial recovery pool contained 3.1 million USDT, translating to roughly one cent per dollar of claimed loss for early redeemers. The ongoing mixer activity suggests a portion of stolen assets remains under attacker control and unrecovered.