--- title: "Drift exploit-linked wallets move 25,700 ETH worth $61.56 million into Tornado Cash" description: "Wallets tied to April's $295 million Drift Protocol exploit sent 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over roughly two hours on Tuesday, Decrypt reported, citing Arkham Intelligence transfer data. The deposits came in batches of 100 ETH (about $237,800 each) plus smaller…" language: en canonical: "https://whycoinmoves.com/en/events/ethereum-drift-exploiter-sends-61m-eth-7f1895a41cb398" published: 2026-10-20T12:42:59.000Z updated: 2026-10-20T20:52:02.000Z indexable: true --- # Drift exploit-linked wallets move 25,700 ETH worth $61.56 million into Tornado Cash Wallets tied to April's $295 million Drift Protocol exploit sent 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over roughly two hours on Tuesday, Decrypt reported, citing Arkham Intelligence transfer data. The deposits came in batches of 100 ETH (about $237,800 each) plus smaller… Attributed sources: [Cointelegraph](), [Decrypt]() ## Key facts Wallets tied to April's $295 million Drift Protocol exploit sent 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over roughly two hours on Tuesday, Decrypt reported, citing Arkham Intelligence transfer data. The deposits came in batches of 100 ETH (about $237,800 each) plus smaller 10 ETH chunks. Arkham's page tracking 71 addresses linked to the attacker still showed 81,454 ETH, roughly $198.58 million, in those wallets. An earlier round on July 23 and 24 moved about 23,095 ETH. Drift said forensic firm Mandiant attributed the attack to North Korean group UNC6862. Evidence strength: Multiple publishers, 2 publisher group(s) (Cointelegraph, Decrypt); this describes source coverage, not truth or causation. After site detection, observed returns were 5 minutes: +0.01% (difference from BTC -0.01 pp; 20/10/2026, 12:42 → 20/10/2026, 12:47, UTC; Gate · USDT); 1 hour: -0.15% (difference from BTC -0.15 pp; 20/10/2026, 12:42 → 20/10/2026, 13:42, UTC; Gate · USDT). Unlisted windows are unavailable. In the preceding 30 days, the 99th percentile of absolute hourly returns was 1.46% (OKX · USDT; cutoff 20/10/2026, 12:42, UTC). This hourly baseline is not directly comparable with a minute move. ## Returns after site detection | Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source | | --- | --- | --- | --- | --- | --- | | 5 minutes | +0.01% | +0.01% | -0.01 pp | 20/10/2026, 12:42 → 20/10/2026, 12:47 | Gate · USDT | | 1 hour | -0.15% | -0.00% | -0.15 pp | 20/10/2026, 12:42 → 20/10/2026, 13:42 | Gate · USDT | | 24 hours | — | — | — | — | — | ## Historical hourly baseline | Metric | Value | | --- | --- | | Ready | true | | Coverage | 100.0% (720/720) | | Median absolute hourly return | 0.19% | | 99th percentile of absolute hourly returns | 1.46% | | BTC beta | 1.12 | | Source / cutoff (UTC) | OKX · USDT / 20/10/2026, 12:42 | ## Claims and open questions - Decrypt, citing Arkham Intelligence, reported the deposits came in batches of 100 ETH worth about $237,800 each, plus smaller 10 ETH chunks. - Arkham's entity page tracking 71 addresses linked to the attacker still showed 81,454 ETH, worth roughly $198.58 million, after the deposits, per Decrypt. - Drift said in June that forensic firm Mandiant attributed the April 1 exploit to UNC6862, a North Korean threat group, according to Decrypt. - Whether the attacker will move the remaining 81,454 ETH, and where any further funds would be sent, would be shown by on-chain data from Arkham or similar trackers. - Whether law enforcement, exchanges or Tether will freeze or recover any of the moved funds, and how much, would be confirmed by official announcements or a notice from those parties. - The exact composition of the roughly $561,600 in other tokens held in the attacker's wallets would be confirmed by an updated on-chain portfolio view. ## Source evidence - [Drift exploiter sends $61M ETH to Tornado Cash, holds $194M]() — Cointelegraph; published 20/10/2026, 12:38; received 20/10/2026, 12:42 (UTC). - [Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash]() — Decrypt; published 20/10/2026, 20:46; received 20/10/2026, 20:49 (UTC). ## Recent ETH events and market reactions - [JPMorgan deploys JPM Coin deposit token on Ethereum mainnet]() — Published 19/10/2026, 17:31 (UTC) · Multiple publishers (4 publishers) · General news · 5m -0.03% / 1h -0.39% - [Ethereum sets Glamsterdam upgrade for Hoodi testnet in October]() — Published 16/10/2026, 00:00 (UTC) · Official source (1 publisher) · Project updates · 1h -0.43% - [Full coin archive]() ## Research for this archive - [Crypto hacks and price impact: Bybit and Cetus case studies]() - [Does crypto news move prices or follow them? A timestamp audit]() - [Altcoin beta to Bitcoin: BTC, ETH, SOL and DOGE hourly returns]() - [Perpetual funding rates and annualized yield: a 2025 comparison]() [Methods and limitations]() Publisher count is not independent evidence count. Price changes cannot verify news or prove causation.