Drift Exploiter Returns to Tornado Cash as Three Tallies Diverge

The wallets behind April's theft from Drift Protocol started moving ether again on Tuesday, after roughly two months of sitting still. Three blockchain trackers watched the same deposits into Tornado Cash and published three different totals for the day. Onchain Lens counted 13,400 ETH, about $32 million. Salus counted 19,600 ETH across 196 transactions, about $46.81 million. Lookonchain counted 25,700 ETH, about $61.56 million, moving over roughly two hours. None of the three accounts addresses the other two.

Three counts of one afternoon

The money left in batches of exactly 100 ether, on The Cryptonomist's reading of the flow, out of an address its account labels Drift Exploiter 5. Lookonchain's post on Tuesday was the version most outlets carried.

"Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash," Lookonchain said.

Crypto Briefing, publishing a day later, measured a longer window and arrived somewhere else again: about 44,510 ETH, roughly $109 million, over the two days to Wednesday. It describes a first tranche of 25,710 ETH and a second worth about $46 million. That first tranche and Lookonchain's whole-day figure sit ten ether apart, close enough to be the same event counted twice. The Wednesday tranche is new in that account and appears in no other read here. Tornado Cash is a mixing service that pools deposits so the address that pays in cannot be matched to the address that takes out.

The balance nobody agrees on

What the wallets still hold is the sharper split. Lookonchain put the remainder at 81,864 ETH on Tuesday, about $195 million. Arkham's dashboard showed 81,454 ETH, about $194 million, a gap of 410 ether between two readings of the same addresses. Crypto Briefing gives about 56,569 ETH, roughly $138 million. That sits some 25,000 ether below the other two, far more than Wednesday's tranche would explain, and neither account mentions the other. We could not establish which balance is current.

What the deposits do not show

A mixer deposit is an observable movement and nothing else. The Cryptonomist set the limit out plainly: the deposits do not, by themselves, establish that the stolen ether was sold on an exchange or turned into cash. No account read here reports a cash-out. Attribution of the original theft has hardened without settling on one name. The Crypto Times reports that Drift credits a Mandiant forensic investigation with tying the attack to a group tracked as UNC6862. The Cryptonomist gives the finding to TRM Labs and Chainalysis, and the group as UNC4736, also called Citrine Sleet. Both describe a state-backed operation run out of North Korea. Crypto Briefing carries both designations and puts the confidence at medium-high.

The loss figure has never settled

Six months on, the size of the 1 April theft is still given three ways. The Crypto Times and Crypto Briefing both say about $295 million. The Cryptonomist says $285 million. Lookonchain's own post describes an attacker who stole "over $270M". How fast it happened splits too. crypto.news reported in September that the protocol, a Solana-based venue for perpetual futures, was drained in 128 seconds, while The Cryptonomist's account says about 12 minutes. The rankings move with the figures: DefiLlama's tracker places Drift third among 2026 hacks, behind Bitget's $387 million and the $320 million that left Liquid's federation, where crypto.news ranked it second in September behind KelpDAO. Those two tallies count different scopes and were published three months apart.

Against any of those numbers the money coming back is small. About $9.2 million of the stolen assets has been frozen, a figure both The Crypto Times and The Cryptonomist carry, though one dates it to a Drift Foundation report on 1 October and the other to a freeze by authorities in August. The amount matches and the timeline does not. Claims through the foundation's DFX token opened on 1 October at about a cent on the dollar, against a recovery pool holding roughly $3.1 million in USDT. Whether Tuesday's ether ever reaches an exchange is a question none of these accounts can answer yet.