Drift Attacker Deposits 25,700 Ether Worth $61.56 Million in Tornado Cash
Key Facts
The attacker linked to the Drift protocol hack deposited 25,700 ether into Tornado Cash in the two hours before an observation published by Lookonchain, which valued the deposits at about $61.56 million. The cryptocurrency transaction tracking platform said the attacker still held a balance of 81,864 ether, worth an estimated $195 million, at the time of the observation. The movement of funds comes as Drift pursues an announced recovery process to address user losses, combining efforts to recover stolen assets with arrangements to fund compensation. Elliptic had said the proceeds of the hack were moved to the Ethereum network, where the attacker converted them into its native currency. The deposits tracked by Lookonchain thus form part of the monitoring of assets transferred after the attack, while the platform continues to implement its compensation and security rebuilding framework.
In its recovery plan published in May, Drift said attacker-controlled wallets on the Ethereum network held about 130,259 ether. That balance dates to the May plan, while the balance reported by Lookonchain relates to the time it observed the Tornado Cash deposits. Elliptic estimated the total value of assets stolen in the hack at about $286 million, an estimate of losses associated with the original attack. In its June recovery update, Drift said an investigation by Mandiant had conclusively attributed the attack to the North Korean threat group known as UNC 6862. On the regulatory front, the U.S. Treasury Department announced the lifting of economic sanctions on Tornado Cash, saying: "We exercised our discretion to lift economic sanctions on Tornado Cash."
The recovery framework Drift outlined in April aimed to address $295 million in outstanding user losses gradually as the platform's revenue grows. That amount relates to recovery obligations to users in the April update, while Elliptic's estimate refers to the value of assets stolen in the hack. The proposed support package included a $100 million revenue-linked credit facility as part of arrangements the platform announced to fund the recovery process. Drift presented the facility as part of a proposed package linking the resolution of losses to the platform's performance and revenue during its recovery. The announced framework places user compensation within a gradual process, alongside efforts to recover funds transferred to attacker-controlled wallets.
Under the claims mechanism announced by Drift, the fixed supply of DFX recovery tokens is about 299,500,810.998 tokens, with user allocations determined by their verified losses. The mechanism allocates 1 DFX for every 1 USDT of those losses, linking each user's share of tokens to the size of their approved claim. At launch, token redemption offered about 0.0104 USDT per token, according to the platform's announcement opening claims. Tokens redeemed by their holders under this mechanism are burned, removing them from circulation in exchange for their allocated amount. The recovery fund held about 3.1 million USDT when claims opened, the balance Drift announced alongside the allocation and redemption terms.
Alongside the compensation arrangements, Drift made the protocol's relaunch conditional on completing two independent audits, under a security rebuilding framework outlined in its April update. This condition makes completion of the security review part of the requirements for resuming operations, alongside the other measures in the recovery framework. The new security framework calls for disabling the durable transaction nonce mechanism for all signers, according to the platform's announcement in the same update. In its June update, Drift announced that Noah Prince, previously head of protocol engineering at Helium, would join as head of protocol. The platform presented his appointment as part of efforts to strengthen its security rebuilding, alongside the announcement of Mandiant's findings on who was responsible for the attack.
As part of its asset recovery efforts, Drift announced in its May plan a 10% bounty on funds successfully recovered, in collaboration with Bybit and other partners. The plan made eligibility for the bounty conditional on the actual recovery of assets, as part of efforts to retrieve funds stolen from the protocol. This process continues alongside the recovery token mechanism through which the platform set the terms for allocating and redeeming users' claims. The announced deadline for claiming DFX tokens is 00:00 UTC on January 1, 2028, according to the announcement opening claims. The claims window therefore remains tied to a fixed closing date, while the protocol's relaunch is subject to completion of the security audits Drift announced under its recovery framework.