Wallets linked to the April exploit of Drift Protocol have transferred approximately 44,510 ETH, worth $109 million, to Tornado Cash over two days, according to blockchain tracking reports published on October 20 and 21, 2026. The transfers mark renewed movement of assets connected to one of this year’s largest decentralized finance security incidents.

The first reported batch involved approximately 25,700 ETH, valued at around $61 million, deposited into Tornado Cash on October 20. A further transfer of about 18,800 ETH, worth roughly $46 million, followed on October 21. Combined, the transactions account for approximately $109 million in Ether routed through the cryptocurrency mixing service.

Tornado Cash pools deposits and enables withdrawals through different addresses, making it more difficult to connect the original sender directly to the recipient. Moving funds through the service can complicate blockchain tracing, although the transfers alone do not prove that the assets have been converted to cash or that investigators can no longer track them.

The transfers are connected to the April 1 Drift Protocol exploit, which caused losses estimated at approximately $295 million. Drift operates on Solana, but a significant portion of the stolen assets was subsequently moved or converted into Ether. The latest transfers represent roughly 37% of the reported original losses, based on the $109 million estimate.

After the latest movements, wallets identified as belonging to the exploiter reportedly retained approximately 56,569 ETH, worth around $138 million, according to data cited in reporting from Arkham Intelligence. Wallet balances and dollar values can change with additional transfers and Ether price movements, so these figures represent reported snapshots rather than fixed totals.

The exploit was attributed by Drift's forensic investigation, conducted with cybersecurity firm Mandiant, to UNC6862, a North Korean threat group, according to earlier reporting. The incident involved attackers obtaining administrative control and using that access to remove assets from the protocol. The scale of the theft and the subsequent movement of funds have made tracing and recovering the assets important issues for affected users.

Drift has begun a recovery process for affected users through DFX recovery tokens. Claims and redemptions opened on October 1, with the recovery pool holding approximately $3.1 million in USDT at launch. The pool is intended to grow through revenue from the relaunched trading platform and recovered assets. However, its initial funding remains small compared with the overall losses, meaning full compensation depends on future contributions and recoveries.

The latest transfers do not establish whether any additional funds will be recovered or whether the movement will lead to further enforcement action. They do, however, highlight the difficulties facing investigators and affected users when large amounts of stolen cryptocurrency move through privacy-focused mixing services. The reported activity also reinforces ongoing concerns about security and asset recovery across decentralized finance platforms.