On-chain monitors including Lookonchain reported that the Drift Protocol exploiter, after roughly two months of inactivity, transferred 25,700 ETH worth approximately $61.56 million into Tornado Cash over a two-hour window on October 20, 2026. The same cluster still controls about 81,864 ETH valued near $195 million. The original April 2026 incident drained an estimated $270–285 million through social-engineering and administrative-key compromise rather than a smart-contract vulnerability; forensic firms have linked the operation to North Korea-affiliated actors. As of the latest deposits, the funds remain partially laundered while the bulk sits in tracked wallets.
The movement leaves the protocol’s recovery efforts and any remaining user-compensation plans intact but further obscures the on-chain trail. Drift has since rebranded toward a relaunch under the Velocity DEX name focused on restitution. No new exploit or protocol-level vulnerability has been reported in connection with the October transfers.
The Drivers of the Current Situation
The main issue is the delayed laundering of proceeds from a major DeFi social-engineering attack. After the April breach, the attacker converted and bridged a large portion of the stolen assets into ETH on Ethereum, then went quiet. A prior partial movement into Tornado Cash occurred in July; the October activity marks the second major wave after another two-month pause. Depositing into the mixer breaks the direct link between the source wallets and any subsequent withdrawals, complicating recovery and law-enforcement tracing.
Related factors have shaped the response. Forensic attribution by Chainalysis, Elliptic and TRM Labs continues to point to the same North Korea-linked cluster previously associated with other high-value DeFi incidents. The protocol itself has shifted resources toward user recovery and a rebranded relaunch rather than immediate fund recovery from the mixer. On-chain observers note that only a fraction of the remaining ETH has entered Tornado Cash so far, leaving the majority still visible and potentially subject to further monitoring or sanctions screening. Only the deposit volumes, residual holdings, and the two-month dormancy period are confirmed by multiple trackers. Broader concerns about state-sponsored laundering routes and the limits of mixer-based obfuscation after large exploits contributed to the heightened scrutiny.
Continued monitoring requires observation of additional Tornado Cash deposits, any exchange inflows, and progress on Drift/Velocity’s recovery program. Limited public detail on exact remaining wallet distributions forms a narrower path for precise forecasting. Blockchain-analytics firms and the affected protocol continue to track the addresses. The situation is a classic delayed-laundering sequence that further distances a portion of the stolen ETH from its original source while the majority remains on-chain and labeled.
Impact and Broader Context
Questions about the Drift exploiter’s renewed Tornado Cash activity keep growing. The transfers create uncertainty about the eventual disposition of the remaining ~$195 million in ETH and whether further mixing or exchange dumps will follow. They also elevate attention on the persistent challenge of recovering funds once they enter privacy tools after sophisticated social-engineering attacks. Users, other DeFi protocols, exchanges and regulators continue to assess the implications.
The issue drives debate on post-exploit fund tracing and the durability of mixer-based obfuscation. It raises questions about the effectiveness of sanctions and analytics against state-linked actors, the residual risk to protocols that rely on multisig or administrative keys, effects on near-term confidence in Solana-based perpetuals platforms, and competition among recovery and insurance mechanisms. Coverage notes that the October movement is the largest single-day Tornado Cash deposit from this cluster since the July activity and occurs while the protocol works toward a relaunch centered on user restitution.
The mid-October on-chain alerts forced renewed focus on unfinished business from the April breach. The current deposits show how subsequent mixer withdrawals, any exchange activity, or additional forensic disclosures will determine the lasting effect.
New large-scale transfers, updated residual balances, or progress reports from the rebranded protocol will clarify the practical reach of the laundering effort.
This analysis uses contemporaneous on-chain reports from Lookonchain and other trackers together with earlier forensic attributions of the April incident. Final recovery rates and the ultimate effectiveness of mixer obfuscation remain subject to further blockchain activity and investigative developments.