After being dormant for around three months, the digital wallet linked to the $285 million hack of Drift Protocol has transferred $44.4 million in Ether (23,095.1 units) into Tornado Cash.
Summary
- Drift’s exploiter deposited 23,095 ETH into Tornado Cash after remaining inactive for three months.
- ZachXBT declined further tracking, citing resources required to monitor and freeze a nine-figure DPRK theft.
- Drift previously announced a recovery bounty program with Arkham and Bybit, contrary to online claims.
According to Etherscan data and security firm PeckShield’s monitoring, the address recently sent 0.85 Ether (ETH) to several digital wallets identified as Bybit deposit locations.
Blockchain data shows that funds started moving on July 23rd and continued through July 24th. Researcher 0xJaelle noticed the activity and alerted ZachXBT, a well-known investigator. ZachXBT responded that he wouldn’t continue tracking the funds unless he received support from an institution.
It looks like the person who exploited the Drift protocol is now transferring the stolen funds. ZachXBT and Tayvano should be aware of this activity.
— JL (@0xJaelle) July 24, 2026
Drift exploiter empties an Ethereum wallet
During the recent activity, the Etherscan address known as “Drift Exploiter 4” handled many transactions. It repeatedly sent 100 ETH, 10 ETH, and 1 ETH to the Tornado Cash system. Additionally, four separate transfers, adding up to 0.85 ETH, were sent to addresses identified as Bybit deposits.
According to Onchain Lens, the hacker behind a previous attack has started moving stolen funds again, quickly sending amounts of 100 ETH at a time to a mixing service—roughly every minute. This wallet hadn’t shown much activity since the initial attack in April.
Tornado Cash mixes deposited funds, allowing users to withdraw them later using new addresses. This makes it harder to directly connect transactions to the original sender and receiver. While investigators can still potentially track activity by analyzing timing, transaction habits, and exchange data, it takes more effort and resources.
The recent recovery efforts only address a portion of the initial theft. Drift reported in April that the stolen assets totaled $295.7 million, including various cryptocurrencies like JLP, USDC, Bitcoin-linked tokens, SOL, and WETH. The protocol stated that a significant amount of the converted funds are still held in four identified Ethereum wallets.
ZachXBT cites cost of tracking North Korea-linked funds
As a researcher following this case, I understand ZachXBT has paused his tracking of the stolen funds. He explained that investigating a hack involving such a large sum – potentially over nine figures and linked to North Korea – and then pursuing asset freezes is simply beyond the capacity of one person working independently. It requires resources he doesn’t currently have available.
He explained that the job would be too hard for one person and required teamwork. ZachXBT also clarified that Drift hadn’t provided any funding or been a customer. In his post on X, he highlighted how expensive and lengthy these investigations can be.
The recent discussions haven’t proven anyone isn’t monitoring these digital wallets. Drift has stated they cooperate with police, cybersecurity experts at Mandiant, and companies specializing in blockchain analysis. Etherscan is still identifying the address, and cryptocurrency exchanges are able to check deposits linked to potentially problematic wallets.
ZachXBT also pointed out issues with Circle following the April attack, where approximately $232 million in stolen USDC was transferred from Solana to Ethereum. The funds passed through Circle’s system that allows transfers between blockchains before the attacker exchanged a significant portion of it for ETH.
Drift had announced a recovery bounty program
JL expressed surprise that Drift didn’t offer a reward for recovering lost funds, despite previously announcing plans to do so. On April 16th, Drift stated they were creating such a program, backed by Arkham and Bybit.
The update didn’t include key details like how much people would receive, who qualified, or when payments would be made. It’s still unknown if the program was ever fully launched, if it continued to track wallets after initial use, or if researchers could get paid for tracing work done at a later time.
Drift developed a plan to help users regain access to their accounts, distinct from efforts to track stolen funds. Tether offered up to $127.5 million in assistance. Drift intends to use remaining assets, funds from partners, and future exchange earnings to issue recovery tokens and allow users to redeem their funds.
An investigation update in June revealed that the attack was carried out by UNC6862, a hacking group believed to be based in North Korea. According to Drift, the attackers didn’t exploit a weakness in the smart contract itself; instead, they used social engineering to gain access. As crypto.news reported, the attackers were able to drain the key vaults in approximately 12 minutes.
Recovery continues as the trail becomes harder to follow
Drift is working to restore its platform and cover losses for its users while investigators try to recover the stolen funds. Any recovered money will go into a dedicated fund for users to claim. Additionally, Drift is improving security by adding stricter requirements for important transactions.
The attack in April wasn’t limited to just one project on Solana. As we’ve noted before, the yield platform Carrot closed down after losses related to Drift significantly reduced the value of funds held on its platform.
Just because the attacker sent funds to Tornado Cash doesn’t mean they’ve successfully cashed out. While the deposits are visible on the blockchain and could be linked to future withdrawals, using Tornado Cash obscures the direct connection between the original wallet and any eventual cash-out, making it more difficult to track the funds.
As of this moment, neither Drift nor Solana has publicly addressed the claims made by ZachXBT. Bybit hasn’t stated whether they’ve investigated the small deposits seen on Etherscan. The location of the remaining stolen funds and the details of Drift’s proposed reward program are still unknown.
2026-07-24 11:34