In April 2026, hackers drained the Solana-based decentralized derivatives exchange within minutes. Security experts have linked the exploit to North Korea’s state-sponsored Lazarus Group. The attackers converted the stolen Solana assets into stablecoins before moving them to Ethereum through a cross-chain bridge.
Following the attack, the Drift Foundation recovered and froze $9.2 million from earlier mixing attempts. On October 1, 2026, the protocol also launched a recovery program to compensate affected users. The program offers DFX tokens, which users can redeem for a share of a Tether recovery pool funded by protocol revenues and recovered assets.
On October 20, 2026, the hacker behind the $285 million Drift Protocol exploit transferred approximately 25,700 ETH, worth $61.6 million, to Tornado Cash, a crypto mixer that makes transactions harder to trace. The attacker deposited the funds in batches of 100 ETH over two hours, ending a two-month period of inactivity.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.
Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).
https://t.co/FRtFrS7rew https://t.co/9ISUIlkHvT
— Lookonchain (@lookonchain) October 20, 2026
Despite this movement, blockchain analytics firms estimate that wallets linked to the attacker still hold between 81,864 and 84,164 ETH, worth up to $200 million. This follows a similar transfer on July 23, 2026, when the attacker moved 23,095 ETH through the same mixer.
Cross-chain transfers make stolen funds harder to recover
The attackers moved the stolen assets from Solana to Ethereum to access Tornado Cash, which can make transaction trails harder to follow. Transferring the entire amount too quickly could trigger automated security alerts and put pressure on the mixer’s liquidity. As a result, the attackers have moved the funds in smaller batches over time.
These movements have raised questions about whether investigators can recover the remaining funds. X user named Crypto Pickup noted that blockchain investigators can trace transactions, but Tornado Cash makes it harder to follow the money. This could significantly reduce the chances of recovering the remaining assets.
Two months of nothing then 61 million into tornado in two hours
still 195 million left to move
forensics track onchain but tornado makes the trail slow
thats over 270 million nobody is getting back
— Crypto Pickup (@pickup_crypto) October 20, 2026
Another user, Clay, pointed to the limitations of cross-chain security. According to the user, the attack shows how stolen funds can move from Solana to Ethereum and pass through a mixer despite the use of cross-chain bridges. Attackers can plan their exit routes across several blockchains, making it harder for investigators to track and recover assets after an exploit.
@lookonchain two months of sitting still, then 25.7k eth into tornado in two hours.
that’s still under a quarter of the stack, with 81.9k eth left in the wallet.
a solana exploit cashing out through an eth mixer is a good reminder that bridges never stop this stuff.
— Clay (@williamclay) October 20, 2026
READ ALSO: Kelp DAO Exploit Sparks Systemic Risk Concerns Across DeFi
Could the Drift Exploiter’s ETH holdings affect the market?
The Drift exploiter’s remaining ETH holdings are large enough to attract market attention. Blockchain monitoring reported approximately 81,864 ETH, worth $195 million, remaining in linked wallets after the October 20 transfers. At an estimated ETH price of $2,380, selling that amount on the open market could create substantial selling pressure. However, the actual impact would depend on how the assets were sold and prevailing market liquidity.
However, moving ETH does not mean selling it. The exploiter could retain the assets, transfer them through additional services, or exchange them for other cryptocurrencies.
This also indicates why large wallet balances matter to crypto market surveillance. Analysts monitor substantial holdings linked to known exploits because sudden transfers can signal potential changes in selling activity, even when no sale has been confirmed.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
