Drift freezes $9.2M from April theft as 107,165 ETH still sits dormant
By Crypto Wire
September 30, 2026
Drift Foundation says about $9.2 million of funds tied to its April 1 security incident is now frozen—still a thin slice of the roughly $295.4 million user-asset theft, and still short of returned cash. Secondary desks including TokenPost (Sep. 30, 10:37 a.m. EDT) and PANews attribute the progress update to the foundation: freezes land after August Tornado Cash hops, while release and return still need law-enforcement process. That is today’s unused Rug Room beat—recovery math, not a Bitget reopen rehash (10355, 10365).
What the trail still shows on Ethereum. Stolen assets were bridged off Solana onto Ethereum, where about 130,259 ETH was split across four wallets. Three of those wallets still hold a combined 107,165 ETH with no recorded transfers in the secondary wraps. A fourth moved roughly 23,094 ETH into Tornado Cash on July 23. The newly cited $9.2 million freeze sits on funds that themselves moved through Tornado Cash in August—attribute those figures to the named desks; do not invent wallet hashes that the wraps did not print.
Attribution and recovery path. Mandiant has identified the attacker cluster as UNC6862, a North Korea–linked threat group, per the same Sep. 30 wraps. Drift previously retained Mandiant, zeroShadow, and SEAL 911 for forensics and tracing. The foundation says assets recovered through freezes, bounties, or law enforcement will feed the DFX recovery / compensation pool, and it is running a public bounty with Bybit that pays 10% of successfully recovered funds. Follow-up pathing for the DRIFT token is still under evaluation—treat that as an open question, not a tokenomics rewrite.
Why collectors and DeFi desks still care. Drift’s April drain remains one of the year’s largest Solana-side treasury hits; any frozen and eventually returned slice changes the DFX pool math that sits beside relaunch and token-path decisions. The freeze is progress, not solvency: $9.2 million against ~$295.4 million is roughly 3% of the cited loss—and the three dormant ETH wallets still dwarf the frozen dollar print if they ever move. Tornado hops and legal hold-ups mean the desk should not treat “frozen” as “back in user wallets” until a primary law-enforcement or foundation release lands. Earlier foundation recovery notes—including the April 16, 2026 incident recovery update—already framed recovered assets as contributions into a dedicated user recovery pool; today’s dollar freeze is a new fact on that same path, not a silent rewrite of the April loss table.
Context on the attacker line. Secondary wraps again cite Mandiant’s UNC6862 North Korea–linked attribution. That sits beside other 2026 recovery desks chasing state-linked clusters, but the actionable beat here is narrower: a quantified freeze, dormant ETH balances, and a Bybit-backed 10% bounty rail. Do not invent that the bounty has already paid out, or that the frozen $9.2 million has cleared into user claims.
What this tick is not. It is not Bitget’s USDT reopen, Protection Fund refill, or SlowMist/Mandiant foothold chapter (10355, 10365, 10362). It is not MiCA deadline-day NFT-series filings (10385). It is not Coinbase’s Pokémon vault-or-ship tease (10392). It is not a republish of Daily Crypto Brief draft 10376—leave that draft alone. It is not a claim that the full 107,165 ETH stack is frozen or returned.
What to watch on-chain next: whether the three dormant ETH wallets holding about 107,165 ETH break silence, and whether Drift or counsel publishes a primary freezes-and-returns schedule that converts the $9.2 million legal hold into DFX pool deposits.
Bottom line: Drift Foundation’s Sep. 30 recovery wrap freezes about $9.2 million from the April ~$295.4 million theft while 107,165 ETH still sits dormant—progress that still needs legal process before DFX returns.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
