In one of the largest cryptocurrency heists of the year, stolen assets linked to the Drift Protocol attack are once again on the move. Blockchain tracking services Onchain Lens and Lookonchain have identified significant Ethereum outflows from wallets associated with the incident, according to data provided by Arkham.
Resumed Activity After Two-Month Dormancy
The wallets, which had remained dormant for two months, have been reactivated as the perpetrators initiated the transfer of assets under their control to the mixing service Tornado Cash. These transactions have been broken down into smaller parts to avoid triggering sharp market volatility and to steer clear of attracting undue attention to ultimate points of sale.
The data from onchain tracking platforms indicates that the attackers are redirecting funds to Tornado Cash in systematic increments rather than in a single transfer.
In just 24 hours, a wallet monitored under the label “Drift Exploiter 5” dispatched 13,400 ETH to mixer contracts, equivalent to roughly $32 million. Analysis platforms, including MistTrack, estimate that daily movements from related wallets could total 25,700 ETH, which is approximately $61.5 million.
The attackers employ the classic technique of transferring funds in precise 100 ETH increments. This approach weakens the direct trace between sender and recipient in open blockchain records, significantly complicating automated tracking efforts.
Second Significant Money Laundering Wave Since July
These current operations are considered the second significant attempt by the attackers to launder the funds. In a similar strategy executed in July, around $44 million was withdrawn via a mixer. However, a substantial portion of the stolen assets remains untapped, with balances reportedly ranging between 82,000 and 94,000 ETH, potentially worth up to $224 million.
In August, law enforcement agencies managed to freeze only about $9.2 million; the transfer of the main volume to Tornado Cash has further complicated potential seizure both technically and legally.
A Twelve-Minute, $285 Million Cyber Heist
Drift Protocol, known as a decentralized trading platform on Solana, suffered the loss of $285 million on April 1, 2026, within a mere twelve-minute window. Due to its meticulous execution, the incident has drawn considerable attention within cybersecurity circles.
Investigations have revealed that attackers exploited hidden vulnerabilities in both Cursor and VSCode, infiltrating devices of platform Security Council members and acquiring their administrative keys. Subsequently, a bogus CarbonVote token was introduced, falsely presented as collateral, leading to the withdrawal of the platform’s genuine reserves.
Compensation Covers Only Minor Losses
For investors affected by the attack, Ethereum’s diversion to mixers further dims prospects of asset recovery. On October 1, Drift Protocol launched a compensation program distributing DFX tokens. However, backed by a Tether-funded buyback reserve, this initiative currently covers only around 1% of the user’s actual losses.
The platform’s team plans to expand this fund with future revenue. Meanwhile, a significant amount of the stolen assets continue to change hands gradually in the open market.
