{"id":14716,"date":"2026-10-20T21:39:49","date_gmt":"2026-10-20T21:39:49","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14716"},"modified":"2026-10-20T21:39:49","modified_gmt":"2026-10-20T21:39:49","slug":"drift-hacker-washes-63m-through-tornado-cash-leaving-recovery-claims-in-limbo","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14716","title":{"rendered":"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>An Ethereum wallet linked to the April 1 exploit of crypto trading protocol Drift sent 25,710 ETH into the Tornado Cash mixer on Oct. 20, nearly emptying the address in its first outgoing Ethereum transactions.<\/p>\n<p>The address, which Etherscan labels \u201cDrift Exploiter 5\u201d, held about 3.98 ETH on Oct. 20. On-chain analysis profile Lookonchain separately reported holdings of 81,864 ETH across the exploiter wallets it tracks.<\/p>\n<h2>258 deposits in two hours and 13 minutes<\/h2>\n<p>The wallet made 258 successful deposits to the Tornado Cash router: 257 of 100 ETH each, followed by a final deposit of 10 ETH. Together, they moved 25,710 ETH out of the address.<\/p>\n<p>The first deposit was confirmed at 07:08:35 UTC in block 26,232,203. The last followed at 09:21:35 UTC in block 26,232,865, completing the sequence in 2 and 13 minutes.<\/p>\n<p>The deposits were worth about $63.1 million, based on Ethereum&#8217;s average price of $2,450 as of Oct. 20.<\/p>\n<p>The movement came more than six months after the April 1 attack. In its April 2 disclosure through Velocity, Drift initially estimated that approximately $280 million had been withdrawn from the protocol.<\/p>\n<p>Drift\u2019s account of the attack described a takeover of its Security Council administrative powers. It said the attacker had used durable nonce accounts to pre-sign transactions and delay their execution, obtaining unauthorized or misrepresented transaction approvals in advance.<\/p>\n<p>At that point, Drift said its investigation had not found a bug in its programs or smart contracts. Its\u00a0update published June 4 said the Mandiant investigation it commissioned had attributed the attack to UNC6862, a North Korean threat group.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter cs-newsletter-brand\" data-newsletter-edition=\"catalyst\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\">\n<div class=\"cs-inline-newsletter__editorial\">\n<p class=\"cs-inline-newsletter__eyebrow\">The Catalyst<\/p>\n<p class=\"cs-newsletter-frequency\">Daily Newsletter<\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">Know what\u2019s moving crypto.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start with the stories that matter. Get the context behind the headlines and a clear view of what to watch next.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__art\" aria-hidden=\"true\"> <img loading=\"lazy\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<\/div>\n<\/div>\n<\/aside>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<h2>How recovered funds reach Drift users<\/h2>\n<p>Drift\u2019s Recovery Pool is one way stolen assets could return to affected users. Drift says funds recovered through freezes, its bounty, or law enforcement go into the pool, alongside a share of the trading platform\u2019s net protocol revenue.<\/p>\n<p>Drift opened DFX claims and redemptions on Oct. 1, allocating one DFX for each USDT of verified loss. A holder can redeem tokens for USDT at the quoted redemption amount. The submitted DFX are burned in the same transaction.<\/p>\n<p>One DFX per USDT of loss records the size of a user\u2019s claim. The USDT paid out depends on the redemption quote at the time of exchange, linking cash recoveries to the funding that entered the pool.<\/p>\n<p>Redeeming exchanges the submitted tokens\u2019 participation in future pool deposits for the USDT payout quoted at the time. A user who redeems only part of a holding keeps that participation for the DFX retained.<\/p>\n<p>As of Oct. 4, the Oct. 1 quote was at about 0.0104 USDT per DFX, close to one cent per USDT lost.<\/p>\n<p>Drift\u2019s April 16 update proposed up to $127.5 million from Tether and $20 million from other partners. The package contemplated a revenue-linked credit facility, an ecosystem grant and market-maker loans.<\/p>\n<p>The Oct. 20 deposits show where this wallet\u2019s ETH went, but how much stolen money ultimately returns to the recovery pool remains unresolved.<\/p>\n<\/div>\n<p>Crime,DeFi,Featured,Hacks,DFX,ethereum,stablecoins,Tether,tornado cashDFX,ethereum,stablecoins,Tether,tornado cash#Drift #hacker #washes #63M #Tornado #Cash #leaving #recovery #claims #limbo1792532389<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An Ethereum wallet linked to the April 1 exploit of crypto trading protocol Drift sent 25,710 ETH into the Tornado Cash mixer on Oct. 20, nearly emptying the address in its first outgoing Ethereum transactions. The address, which Etherscan labels \u201cDrift Exploiter 5\u201d, held about 3.98 ETH on Oct. 20. On-chain analysis profile Lookonchain separately<\/p>\n","protected":false},"author":1,"featured_media":14717,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[7477,109,404,3087,2314,31,2670,531,1641,662,282,218,3207,6778,7498],"class_list":["post-14716","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-63m","tag-cash","tag-claims","tag-dfx","tag-drift","tag-ethereum","tag-hacker","tag-leaving","tag-limbo","tag-recovery","tag-stablecoins","tag-tether","tag-tornado","tag-tornado-cash","tag-washes"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"A Drift exploiter wallet sent 25,710 ETH into Tornado Cash in 258 deposits on Oct. 20, nearly emptying the address during its first outgoing transfers.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=14716\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo\" \/>\n<meta property=\"og:description\" content=\"A Drift exploiter wallet sent 25,710 ETH into Tornado Cash in 258 deposits on Oct. 20, nearly emptying the address during its first outgoing transfers.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=14716\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-20T21:39:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14716\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=14716\",\"name\":\"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14716#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14716#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp\",\"datePublished\":\"2026-10-20T21:39:49+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"A Drift exploiter wallet sent 25,710 ETH into Tornado Cash in 258 deposits on Oct. 20, nearly emptying the address during its first outgoing transfers.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14716#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=14716\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14716#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14716#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo - Crypto News: Latest Cryptocurrency News and Analysis","description":"A Drift exploiter wallet sent 25,710 ETH into Tornado Cash in 258 deposits on Oct. 20, nearly emptying the address during its first outgoing transfers.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=14716","og_locale":"en_US","og_type":"article","og_title":"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo","og_description":"A Drift exploiter wallet sent 25,710 ETH into Tornado Cash in 258 deposits on Oct. 20, nearly emptying the address during its first outgoing transfers.","og_url":"https:\/\/cryptonews.uk.com\/?p=14716","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-10-20T21:39:49+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=14716","url":"https:\/\/cryptonews.uk.com\/?p=14716","name":"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=14716#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=14716#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp","datePublished":"2026-10-20T21:39:49+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"A Drift exploiter wallet sent 25,710 ETH into Tornado Cash in 258 deposits on Oct. 20, nearly emptying the address during its first outgoing transfers.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=14716#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=14716"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=14716#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/ethereum-mixer-conveyor-flow.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=14716#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Drift hacker washes $63M through Tornado Cash, leaving recovery claims in limbo"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14716"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14716\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/14717"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}