After three months of inactivity, the wallet linked to the Drift Protocol exploit moved 23,095.1 ETH worth around $44.4 million into the Ethereum mixer Tornado Cash. These transfers occurred rapidly between July 23 and 24, with batches of 100, 10, and 1 ETH sent in quick succession.
Complicating the Trail
The wallet tagged as “Drift Exploiter 4” also sent 0.85 ETH to addresses identified as Bybit deposit wallets. Observers remain uncertain whether this was a test of exchange compliance or just random activity; Bybit has not commented publicly. Independent investigator ZachXBT stated he would stop tracking the stolen funds, citing the huge workload of monitoring a theft linked to a North Korean threat group with nine-figure amounts involved.
Earlier analysis attributed the original hack to UNC6862, a North Korean group that exploited social engineering instead of smart contract vulnerabilities. The total estimated stolen value from the attack reaches approximately $295.7 million in a mix of assets including JLP, USDC, Bitcoin-related tokens, SOL, and WETH.
Depositing funds into Tornado Cash obscures direct links between wallets. Mixing breaks on-chain connections, making it harder for investigators to track the money’s path. The Drift Protocol's recovery plans include pooling reclaimed funds for users and issuing recovery tokens, although the current status of the bounty program remains unclear.
