Skip to content
Large Ethereum Laundering from Drift Exploit: $61 Million Transferred

Large Ethereum Laundering from Drift Exploit: $61 Million Transferred

First seen 20 Oct 2026, 22:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 23:46 UTC
  • •Hackers transferred $61 million in Ethereum to Tornado Cash from the Drift exploit.
  • •The attack was attributed to North Korean group UNC4736, involving a six-month infiltration.
  • •Most stolen funds remain unclaimed, complicating recovery for affected investors.

On October 20, 2026, wallets linked to the April 1 Drift Protocol exploit transferred 25,700 Ethereum, valued at approximately $61.5 million, to the Tornado Cash mixer. The hackers, identified as a North Korean group, UNC4736, had previously withdrawn $44 million in July using similar methods. The exploit, which drained $295 million from Drift Protocol, involved a six-month operation where attackers posed as a legitimate trading firm. Currently, the exploiter's wallets still hold around 81,454 ETH, worth roughly $198 million. The use of Tornado Cash complicates recovery efforts for affected investors, as most of the stolen funds remain untouched. Law enforcement previously managed to freeze only $9.2 million of the stolen assets. Drift Protocol has initiated a recovery program for affected users, but early redemption values are significantly low.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-04-01
Drift Protocol exploit occurred
The exploit drained $295 million from Drift Protocol in just 12 minutes, using a fake token to manipulate liquidity.
Decrypt.Co
2026-07-23
First laundering attempt via Tornado Cash
Hackers transferred 23,095 ETH, worth around $44 million, to Tornado Cash in a similar manner to the recent transfers.
Decrypt.Co
2026-10-20
Recent transfer of stolen Ethereum
Wallets linked to the Drift exploit moved 25,700 ETH, valued at $61.5 million, to Tornado Cash after two months of inactivity.
Decrypt.Co

More articles in this cluster (4)

Following this threat?

Track Citrine Sleet and Drift Protocol in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 2

Common questions

How much Ethereum is still held by the attackers?
The attackers still hold approximately 81,454 ETH, worth around $198 million.
What was the method of the Drift Protocol exploit?
The exploit involved gaining admin access, creating a fake token, and using it to withdraw real liquidity.
What recovery options are available for affected investors?
Drift Protocol has launched a recovery program, but early redemption values are very low, around a penny on the dollar.