Blockchain tracker Onchain Lens reported that the addresses sent approximately 25,710 ETH on October 20 before transferring another 18,800 ETH on October 21. The combined dollar value represents about 37% of the losses reported after the April 1 attack on the Solana-based decentralized exchange.
Despite the transfers, Arkham-labeled exploiter wallets reportedly retained approximately 56,569 ETH, worth $138 million, leaving a substantial amount of stolen cryptocurrency outside the latest mixing activity.
The developments intensify uncertainty surrounding Drift’s recovery program, which began distributing DFX compensation tokens earlier this month and relies partly on recovering assets from the attacker.
How Much of the Stolen ETH Has Reached Tornado Cash?
The latest transactions expand an operation that resumed Tuesday after approximately two months of inactivity. As FinanceFeeds reported on October 20, wallets associated with the exploiter transferred roughly 25,700 ETH, then valued at $61.6 million, to Tornado Cash over approximately two hours.
Wednesday’s additional deposits lifted the two-day total to 44,510 ETH. Estimates of Tuesday’s dollar value differ slightly because blockchain trackers used different observation times and ETH prices.
The October activity follows another substantial transfer in July. At that time, 23,095 ETH worth approximately $44.4 million entered Tornado Cash from an address associated with the Drift exploit.
Combining the July and October transactions puts the reported amount routed through the mixer at approximately 67,605 ETH, although the dollar values at the respective transfer dates are not directly comparable.
Tornado Cash allows users to deposit cryptocurrency and subsequently withdraw it to other addresses without an obvious public link between the transactions. This complicates blockchain tracing and efforts to identify where stolen funds ultimately move.
However, transfers into a mixer do not establish that the assets have been sold, converted into cash or permanently removed from investigators’ reach.
Investor Takeaway
The $109 million represents previously stolen assets changing addresses, not additional losses or confirmed ETH selling. The financial concern is whether the transfers reduce the amount investigators can ultimately recover for Drift’s affected users.
Why Does the Activity Matter for Drift’s $295M Recovery?
Drift reported approximately $295.4 million in user losses from the April 1 exploit. Its subsequent investigation, conducted with cybersecurity firm Mandiant, attributed the attack to UNC6862, a North Korean threat group associated with other state-sponsored cryptocurrency operations.
The attribution is based on forensic investigation rather than a criminal conviction identifying the individuals behind the wallets.
Drift Foundation previously disclosed that approximately $9.2 million in stolen assets had been frozen. However, releasing those assets requires legal and law-enforcement procedures, meaning the frozen amount cannot yet be treated as recovered compensation.
The distinction is particularly important for holders of DFX, the recovery token introduced to represent verified losses.
Drift opened DFX claims and redemptions on October 1, issuing one token for every USDT of verified losses. The fixed supply totals approximately 299.5 million DFX.
At launch, the recovery pool held approximately 3.1 million USDT, giving each DFX an initial redemption value of 0.0104 USDT, equivalent to roughly one cent per dollar lost.
The pool receives contributions from the rebuilt Velocity trading platform, with additional funding potentially coming from partner commitments and recovered assets.
Investor Takeaway
The initial recovery pool covered only about 1% of verified losses. Even the previously frozen $9.2 million remains unavailable until returned through the appropriate procedures. Further mixing activity increases uncertainty around a potentially important source of compensation.
What Happens to the Remaining $138M in ETH?
The roughly 56,569 ETH reportedly remaining in attacker-linked wallets represents a substantial pool of assets that investigators may continue monitoring for transfers, exchange deposits or further interactions with privacy services.
Drift has also outlined support commitments of up to $127.5 million from Tether and $20 million from other partners. These commitments involve different funding arrangements and should not be counted as cash already available for DFX redemptions.
Velocity’s operating performance provides another measurable recovery channel. Under Drift’s published mechanism, between 60% and 90% of daily net protocol revenue, depending on the applicable revenue bands, contributes to the recovery pool.
For DFX holders, the relevant indicators are therefore actual asset recoveries, the outstanding exploiter-wallet balances and the USDT redemption value per token.
The latest transfers make the distinction between visible stolen assets and realistically recoverable funds increasingly important. While further wallet movements may reveal additional evidence, neither the remaining ETH balance nor the amount entering Tornado Cash establishes how much affected users will ultimately receive.
Investor Takeaway
DFX recovery depends on funds actually reaching the redemption pool, not the market value of ETH still attributed to the attacker. Confirmed asset returns and sustainable exchange revenue will provide stronger evidence of recovery progress than wallet balances alone.