Drift attacker mixes $61 million in ethereum while retaining $194 million

The exploiter behind the major Drift protocol incident has moved a substantial amount of stolen funds through the privacy mixer Tornado Cash. According to on-chain data tracked by our team, the perpetrator transferred $61 million worth of Ether into the mixing service, while continuing to hold roughly $194 million in remaining assets across various wallets.

The initial breach occurred on April 1 and resulted in total estimated losses of about $295 million. In the wake of the incident, security firms launched comprehensive investigations to trace the stolen capital across multiple blockchain networks. Subsequent findings from a Mandiant investigation formally attributed the sophisticated attack to a North Korean threat group, highlighting the involvement of state-sponsored actors in major cryptocurrency heists.

For the broader decentralized finance market, this development underscores the persistent challenge of tracking and recovering funds once they enter privacy-enhancing protocols. The ability of threat actors to launder tens of millions of dollars through services like Tornado Cash demonstrates ongoing vulnerabilities in the lifecycle of cross-chain exploits and tests the limits of current on-chain surveillance tools.

Security analysts and blockchain forensics experts have been closely monitoring the movement of these funds, noting the distinct operational patterns typical of state-backed hacking syndicates. The reliance on advanced obfuscation techniques continues to draw scrutiny from regulators and compliance advocates who monitor illicit flows within the digital asset ecosystem.

As the remaining $194 million sits in associated addresses, investigators and law enforcement agencies will likely maintain surveillance on those wallets for any future transfer attempts. The outcome of this tracking could set new precedents for how protocols and security firms respond to large-scale APT-linked exploits moving forward.