Drift April Exploit Trail
What’s new
Wallets linked to the April 1 Drift exploit deposited about 25,700 ETH (~$61.56 million) into Tornado Cash on October 20, 2026 after roughly two months quiet, per Lookonchain. Residual holdings still sit near 81.5k–81.9k ETH (~$194–$195 million). DFX recovery claims remain open through January 1, 2028.
Timeline
- Oct 20, 2026Drift exploiter wallets send about $61.6 million in ETH to Tornado CashSecond chapter — 25,700 ETH mixer deposits after ~2 months inactivity; residual ~$194–$195M ETH still held.
- Sep 30, 2026Drift freezes $9.2M from April theft as 107,165 ETH still sits dormantOpening chapter — freeze print + dormant ETH stack after Mandiant UNC6862 attribution.
What’s next
- Reconciled Tornado deposit hashes for the full 25,700 ETH cluster (Lookonchain / Arkham).
- Residual ETH hops from the ~81k–82k ETH wallets toward bridges or CEXs.
- Any new freeze / recovery dollars added to the DFX pool after this week’s mixer activity.
- Stop when the trail is cold ~48h with no new primary source and no fresh mixer / CEX hop.