Wallets linked to the April 1 Drift Protocol exploit moved 25,700 ETH — roughly $61 million — into Tornado Cash over roughly two hours on Tuesday, October 20, after about two months of inactivity, according to blockchain analytics platform Lookonchain.

Tornado Cash is a mixer that pools funds from multiple addresses and obscures transaction trails, making tracing far harder.

The deposits represent nearly 37% of the approximately $295 million stolen from the Solana-based decentralized exchange in April, and they landed just as victims were still waiting on recovery payments.

The exploit has already been attributed. Drift said in June that a forensic investigation by cybersecurity firm Mandiant tied the attack to UNC6862, a North Korean threat group, yet the wallets went quiet for two months and then resumed mixing anyway.

CryptoTicker noted that the renewed use of Tornado Cash after a prior July transfer suggests whoever controls the wallets still considers hiding the transaction trail a priority.

Cryptopolitan reported the deposits continue a money-laundering process traced to a North Korea state-sponsored organization, signaling the operation is proceeding despite public attribution and frozen assets.

Analytics firms watching different address groups and time windows produced different totals.

Lookonchain counted 25,700 ETH, about $61.56 million, while Salus independently tallied 19,600 ETH, roughly $46.81 million, across 196 individual transactions, and Onchain Lens reported 13,400 ETH, around $32 million, from an address it labeled "Drift Exploiter 5" — CryptoTicker said the divergence came from each service watching different addresses.

Cointelegraph said the exploiter-labelled wallets still held 56,569 ETH, about $138 million, after Wednesday's flurry of transfers.

The Drift exploit ranks as 2026's third-largest crypto hack, per Cointelegraph, behind a $387 million Bitget hack and a $320 million Liquid Network exploit.

Drift opened claims and redemptions for DFX recovery tokens on October 1; those tokens give affected users a claim on a recovery pool that held about $3.1 million at launch and receives exchange revenue and any recovered funds.

Drift said about $9.2 million in stolen assets were frozen, but returning that money requires legal and law-enforcement steps, so it cannot yet count as compensation. Cryptopolitan said the renewed deposits matter for the thousands of Drift users who have not yet received payment.