Drift exploit-linked wallets move 25,700 ETH worth $61.56 million into Tornado Cash
Wallets tied to April's $295 million Drift Protocol exploit sent 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over roughly two hours on Tuesday, Decrypt reported, citing Arkham Intelligence transfer data. The deposits came in batches of 100 ETH (about $237,800 each) plus smaller 10 ETH chunks. Arkham's page tracking 71 addresses linked to the attacker still showed 81,454 ETH, roughly $198.58 million, in those wallets. An earlier round on July 23 and 24 moved about 23,095 ETH. Drift said forensic firm Mandiant attributed the attack to North Korean group UNC6862.
2 independent publishers report it (copies of the same text count once); they may still rely on one underlying source. An official source would raise it.
Security topic · core coin ETH · 2 publishers
Fresh security news
Three separate rule-based signals. None is the probability that the report is true. How they work ↗
Key facts
Attributed sources: Cointelegraph Decrypt
ETH after this site detected it
- 5 minutes+0.01%vs BTC -0.01 pp
- 1 hour-0.15%vs BTC -0.15 pp
- 24 hours—Window not complete
Claims and open questions
What sources claim
- Decrypt, citing Arkham Intelligence, reported the deposits came in batches of 100 ETH worth about $237,800 each, plus smaller 10 ETH chunks.
- Arkham's entity page tracking 71 addresses linked to the attacker still showed 81,454 ETH, worth roughly $198.58 million, after the deposits, per Decrypt.
- Drift said in June that forensic firm Mandiant attributed the April 1 exploit to UNC6862, a North Korean threat group, according to Decrypt.
Still unresolved
- Whether the attacker will move the remaining 81,454 ETH, and where any further funds would be sent, would be shown by on-chain data from Arkham or similar trackers.
- Whether law enforcement, exchanges or Tether will freeze or recover any of the moved funds, and how much, would be confirmed by official announcements or a notice from those parties.
- The exact composition of the roughly $561,600 in other tokens held in the attacker's wallets would be confirmed by an updated on-chain portfolio view.
Model-assisted explanation; citations, numbers and output format are checked. This is not independent semantic verification.
Source evidence
cointelegraph.com
Published 20/10/2026, 12:38 · Received 20/10/2026, 12:42
decrypt.co
Published 20/10/2026, 20:46 · Received 20/10/2026, 20:49
Original source titles remain in their source language. Full articles are not republished.
Market reaction after detection
Returns start at the sample closest to site detection (within the same minute up to 10 minutes later), using the same data source and quote currency. Actual sample times are shown; missing observations remain blank.
| Window | Return | BTC | Difference from BTC (pp) | Actual sampled interval / source |
|---|---|---|---|---|
| 5 minutes | +0.01% | +0.01% | -0.01 pp | 20/10/2026, 12:42 → 20/10/2026, 12:47 (UTC) Gate · USDT |
| 1 hour | -0.15% | -0.00% | -0.15 pp | 20/10/2026, 12:42 → 20/10/2026, 13:42 (UTC) Gate · USDT |
| 24 hours | — | — | — | Awaiting a complete valid window |
Historical market context
Research: hourly returns and BTC beta →
Closed hourly candles from the 30 days before this event observation. Different venues are kept separate.
| Metric | Value |
|---|---|
| Hourly coverage | 100.0% (720/720) |
| Median absolute 1h return | 0.19% |
| 99th percentile of absolute 1h returns | 1.46% |
| Historical hourly BTC beta | 1.12 (719 matched returns) |
OKX · USDT · Context as of 20/10/2026, 12:42 · Last included candle closed 20/10/2026, 12:00
Hourly descriptive statistics, not minute-move probabilities. Backfilled history never moves the observation cutoff above.
Event timeline
Source publication, receipt and analysis times are separate. All times UTC.
Source published: Cointelegraph
Source received: Cointelegraph
Event first detected by this site
Evidence record updated
Source published: Decrypt
Source received: Decrypt
Additional source received; evidence recalculated
English explanation generated
Latest content update
Recent ETH events and market reactions
- JPMorgan deploys JPM Coin deposit token on Ethereum mainnet [Multiple publishers · Published 19/10/2026, 17:31 (UTC) · Multiple publishers (4 publishers) · General news · 5m -0.03% / 1h -0.39%]
- Ethereum sets Glamsterdam upgrade for Hoodi testnet in October [Official source · Published 16/10/2026, 00:00 (UTC) · Official source (1 publisher) · Project updates · 1h -0.43%]