Drift Exploiter Sends $63 Million to Tornado Cash

A wallet linked to the April 1 exploit of crypto trading protocol Drift sent 25,710 ETH to the Tornado Cash router in 258 deposits on Oct. 20. The transfers were worth about $63 million based on Ethereum’s average price that day.

The address, labeled “Drift Exploiter 5” by Etherscan, made 257 deposits of 100 ETH and a final deposit of 10 ETH. The first transaction was confirmed at 07:08:35 UTC, and the last at 09:21:35 UTC, completing the transfers in two hours and 13 minutes.

The wallet held about 3.98 ETH after the transactions. The deposits occurred more than six months after the attack, which Drift disclosed on April 2. The protocol initially estimated that about $280 million had been withdrawn.

Drift’s account of the attack described a takeover of its Security Council’s administrative powers. The attacker used durable nonce accounts to pre-sign transactions, delay their execution and obtain unauthorized or misrepresented approvals.

Drift’s initial investigation found no vulnerability in its programs or smart contracts. In a June 4 update, the protocol attributed the attack to UNC6862, a North Korean threat group, based on an investigation by cybersecurity firm Mandiant.

Drift’s Recovery Pool receives assets recovered through freezes, the protocol’s bounty program and law enforcement actions. It also receives part of the trading platform’s net protocol revenue. The Oct. 20 transactions establish where the ETH in the wallet was sent, but do not establish whether any of it can be recovered or returned to the pool.

Drift opened claims and redemptions for its DFX tokens on Oct. 1. Users received one DFX token for each USDT of verified loss and can exchange the tokens for USDT at the quoted redemption amount. The redeemed tokens are burned in the same transaction.

The redemption price depends on the funds available in the Recovery Pool and can change over time. On Oct. 4, Drift reported that the quote from Oct. 1 was about 0.0104 USDT per DFX. Users who redeem part of their DFX holdings retain their participation in future pool deposits for the tokens they keep.

Drift’s April 16 recovery proposal included up to $127.5 million from Tether and $20 million from other partners. The proposal included a revenue-linked credit facility, an ecosystem grant and loans from market makers.