www.cryptopolitan.com Drift Protocol Hack: $285M Stolen Funds Transferred After Months of Dormancy
Article Content
- •The Drift Protocol hack resulted in a loss of $285 million due to social engineering tactics.
- •Stolen funds are being laundered through Tornado Cash, a method associated with North Korean hackers.
- •The recent transfers represent the first significant movement of stolen assets in four months.
In April 2026, the Drift Protocol was hacked, leading to a loss of approximately $285 million. The Ethereum wallet known as 'Drift Exploiter 4' began transferring these stolen funds on July 25, 2026, with significant amounts sent to Tornado Cash and Bybit. Blockchain security firm PeckShield reported that $44.4 million in 23,095.1 ETH was moved to Tornado Cash, while a smaller transfer of 0.85 ETH went to Bybit. Investigators suspect the operation is linked to North Korean state hackers, as the laundering patterns align with known tactics. The attack was attributed to a social engineering campaign rather than a flaw in the smart contracts. The funds' movement marks the first significant activity in four months, raising concerns about further cash-out attempts. The incident has severely impacted Drift's total value locked, reducing it by over 50%.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Drift Protocol in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…