SECURITY ALERT

The mixer has seen this money before.

This morning it came back for more.

Wallets labelled as belonging to the attacker behind Drift Protocol’s April exploit began depositing ether into Tornado Cash again on Tuesday, 20 Oct, with at least 19,600 ETH (about $46.8 million) sent by about 09:15 UTC, according to the security firm Salus.

Other trackers count more.

PeckShield put the figure at about 21,300 ETH at 08:54 UTC. Lookonchain counted 25,700 ETH, about $61.6 million, by 09:25 UTC.

These are reported figures, posted at different times while the deposits were still running. CryptoWatchDesk has not reconciled them transaction by transaction.

Tornado Cash is a mixer: it pools deposits of fixed sizes, such as 100 ETH, and lets them be withdrawn to fresh addresses, which breaks the visible link between sender and receiver.

Salus counted 196 transactions. At 100 ETH each, that matches its total, by our arithmetic.

The timeline, in UTC

  • 1 Apr. Drift, which Elliptic described as the largest decentralised perpetual-futures exchange on Solana, is drained. Elliptic later put the loss at $286 million.
  • 2 Apr. Drift says an attacker used “a novel attack involving durable nonces” to take over its Security Council’s administrative powers, in a post on X.
  • 23 to 24 Jul. A wallet labelled “Drift Exploiter 4” sends 23,095 ETH, then about $44.4 million, into Tornado Cash, crypto.news reported.
  • 20 Oct, 08:31. Onchain Lens flags at least 13,400 ETH moving to Tornado Cash after two months of inactivity.
  • 20 Oct, 08:54 to 09:25. PeckShield, Salus and Lookonchain post rising totals.

Why move now, after two quiet months?

What is left

Plenty.

Lookonchain said the attacker still held 81,864 ETH, about $195 million, at 09:25 UTC. Earlier, Onchain Lens counted 93,965 ETH and about 477,000 of Ondo’s USDY tokens across the wallets it tracks.

The two counts were taken an hour apart, during the deposits.

The wallets are grouped under a public Arkham entity page.

Ether was trading at $2,377.87 at 09:52 UTC, according to CoinGecko.

None of the tracker posts reported a freeze.

So who is behind the wallets?

Who, according to whom

Drift said on 5 April, with “medium-high confidence”, that the operation was carried out by the same threat actors as the October 2024 Radiant Capital hack, which Mandiant attributed to UNC4736, a North Korean state-affiliated group, in an update on X quoted by Elliptic. Elliptic said it had found multiple indicators suggesting a link to North Korea.

No authority has charged anyone over the exploit.

Drift’s X account now operates under the name Velocity. The Drift Foundation opened recovery claims on 1 Oct with about 3.11 million USDT in the pool, enough for initial payouts near 1% of verified losses, crypto.news reported. Future funding is meant to come from Velocity revenue, Tether, partners and any recovered stolen assets.

Velocity’s official X account had posted nothing about today’s movements by 10:00 UTC.

The pattern, a long wait and then a mixer, is familiar from how Bitget’s stolen funds moved through THORChain and CoinJoin.

What does a mixer deposit mean for anyone still owed money?

What we do not know

  • The final total for today’s deposits, and whether more wallets will follow.
  • Whether any exchange or stablecoin issuer has frozen funds linked to the wallets.
  • How much of the stolen ether the recovery pool can still expect to see.

Protect yourself

  • If you are a Drift claimant, use only links from the project’s official channels. Exploits with public recovery processes attract fake claim sites.
  • Nobody legitimate needs your seed phrase to process a claim (why the recovery phrase is the master key).
  • Treat any “recovery service” that promises to retrieve mixed funds for a fee as a likely scam.

When stolen money can sit for months and leave in an afternoon, who is watching the exits?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.