Stolen crypto rarely disappears in one move. It waits, then moves in waves. On Tuesday, October 20, 2026, wallets that on-chain analysts link to the April Drift Protocol exploit woke up after roughly two months and started pushing ether into Tornado Cash — between $32 million and $61.6 million of it, depending on who counted.
The bigger number is what is left: about 81,500 ETH, or close to $195 million, still sitting with the attacker.
Key facts
- On October 20, 2026, wallets linked to the Drift exploiter moved ether into Tornado Cash after about two months of inactivity.
- Lookonchain counted 25,700 ETH (about $61.56 million) in two hours; Salus counted 19,600 ETH (about $46.81 million) across 196 transactions; Onchain Lens first reported 13,400 ETH (about $32 million).
- Arkham put the remaining attacker balance at about 81,454 ETH (about $194 million); Lookonchain at about 81,864 ETH.
- The Drift Foundation puts the amount taken from users in the April 1, 2026 attack at about $295.4 million.
- About $9.2 million, roughly 3% of the total, has been frozen; release runs through law enforcement.
- Mandiant attributes the attack to North Korean group UNC6862, while TRM Labs and Chainalysis point to UNC4736 (Citrine Sleet), also linked to North Korea.
What happened to the Drift hack funds on October 20?
After roughly two months without activity, addresses tied to the Drift exploiter started depositing ether into Tornado Cash. Lookonchain counted 25,700 ETH flowing in within two hours — about $61.56 million at the day’s price of roughly $2,436. Other trackers saw smaller totals because they followed different subsets of addresses.
Security firm Salus counted 19,600 ETH across 196 individual transactions, and Onchain Lens initially reported 13,400 ETH from an address it labels “Drift Exploiter 5”. The spread between estimates is normal: each firm clusters wallets differently, and mixer deposits come in fixed-size chunks that are easy to miss.
Where the Drift case stands
Drift was a derivatives venue on Solana. The attack on April 1, 2026 drained about $295.4 million from users, according to the Drift Foundation’s recovery report. The platform has since relaunched under the name Velocity. A compensation pool under the DFX ticker accepts claims; first payouts in early October were slightly above 1% of user losses.
A hack is one day. Laundering is a calendar.
Who is behind the Drift Protocol exploit?
Attribution points to North Korea, but not to one agreed group. In its June 3 report, the Drift Foundation relayed that Mandiant attributes the attack to UNC6862. TRM Labs and Chainalysis instead point to UNC4736, also known as Citrine Sleet. No authority has published a conclusive public finding.
Mandiant, zeroShadow and SEAL 911 are involved in tracing funds. A public bounty of 10% on recovered funds was posted jointly with Bybit. Drift proceeds had already passed through Tornado Cash once before, in August 2026.
Is Tornado Cash still sanctioned?
No. The US Treasury removed Tornado Cash from its sanctions list on March 21, 2025, following the November 2024 Fifth Circuit ruling in Van Loon v. Department of the Treasury. The OFAC notice is titled “Cyber-related Designation Removal; North Korea Designation Update and Removal”. Using the mixer is not itself sanctioned, but laundering stolen funds through it remains a crime.
Tornado Cash uses fixed denominations and zero-knowledge proofs, so a withdrawal can’t be linked unambiguously to a specific deposit. That is precisely why exchanges and swap providers screen withdrawals that come out of mixers: a deposit with a mixer history may be held until its origin is clarified.
What this means for swap users
When large stolen sums move, compliance teams across the industry tighten screening. Providers that route swaps — including the licensed exchanges SwapZilla aggregates — run their own AML checks and may pause a transaction whose inputs trace back to flagged addresses. Our AML policy explains how that works, and the refund address guide covers what happens if a provider declines a deposit.
For ordinary users the practical advice is simple: receive coins only from sources you know, and keep records. Privacy tools such as Monero exist for legitimate reasons — our private route explainer describes what SwapZilla’s Monero-based option does and doesn’t do — but no privacy route is a way around a provider’s screening of stolen funds.
Final thoughts
Six months after the attack, only about 3% of Drift’s losses are frozen and the attacker still controls around $195 million in ETH. The October 20 wave won’t be the last. Expect the rest to move the same way: quietly, in chunks, whenever the attention fades.