North Korea's Drift Haul: $61M Through Tornado Cash, $194M Still Free
The wallet tied to North Korea's $295M Drift Protocol hack deposited 25,700 ETH into Tornado Cash on October 20, leaving roughly $194M still in exploiter-controlled addresses and a victims' recovery pool that started at $3.1M.
A six-month DPRK infiltration netted $295M. Law enforcement clawed back a fraction. Now the laundering accelerates.
Key takeaways
- A wallet linked to the April 1 Drift Protocol hack deposited 25,700 ETH (~$61M) into Tornado Cash over two hours on October 20, after roughly two months of dormancy, per blockchain analytics account Lookonchain.
- Exploiter-controlled addresses still hold approximately 81,454 ETH (~$194M), per Arkham Intelligence, against a victims' recovery pool that held approximately $3.1M at launch on October 1, per reports at the time.
- Mandiant attributed the hack to UNC6862, a North Korean threat group, in Drift's official June 3 recovery update; law enforcement has frozen only a reported ~$9.2M of a ~$295M haul.
A wallet tied to the Drift Protocol exploiter deposited 25,700 ETH, worth approximately $61M at time of transfer, into Tornado Cash on October 20, 2026. The move came after roughly two months of inactivity and follows a prior mixer deposit of approximately 23,095 ETH in late July, making this the second confirmed laundering tranche from a heist Mandiant formally attributed to a North Korean state-linked threat group.
Blockchain analytics account Lookonchain flagged the transfer on X. Arkham Intelligence shows exploiter-controlled addresses holding approximately 81,454 ETH (~$194M) after the deposit. The ~$387.5M Bitget hack and the ~$320M Liquid Network exploit rank among the largest crypto exploits of 2026 per DefiLlama's hacks tracker.
How $295M Left Drift in 12 Minutes
The April 1 hack was not a smart contract bug. It was a patient, industrial-grade social engineering campaign that ran for roughly six months. Attackers posed as a trading firm, deposited $1M in real capital to establish credibility, met Drift contributors in person at conferences, and ultimately exploited a code execution vulnerability in developer tooling alongside a fake wallet application, according to Drift's own post-mortem at drift.trade/updates. Once inside, they drained the protocol in under 12 minutes.
The attack surface was Drift's Security Council multisig, a permissioned human layer, not the underlying code. Attackers didn't break the cryptography. They broke the people.
Mandiant's forensic investigation left no ambiguity:
"Mandiant's investigation conclusively attributed the attack to UNC6862, a North Korean threat group with direct ties to other state-sponsored actors involved in similar attacks on other platforms." , Drift Protocol, official recovery update, June 3, 2026
UNC6862's tactics are consistent with the broader DPRK cyber-theft apparatus. The Drift playbook, a multi-month infiltration with planted identities and bona-fide capital as cover, is repeatable across any DeFi protocol that relies on a human governance layer.
The Recovery Math Is Brutal
Drift opened DFX recovery token claims on October 1. The pool held approximately $3.1M at launch per reports at the time, and accrues exchange revenue plus any funds actually recovered. Against $295M in losses, that is a roughly 1% recovery rate on day one. The $61M moved into Tornado Cash on October 20 represents a tranche of stolen funds almost certainly beyond practical law enforcement reach.
Law enforcement has reportedly frozen approximately $9.2M of the stolen funds. That is 3.1 cents on the dollar. The exploiter still controls roughly $194M.
This is the custodial risk Bitcoiners have been describing for years. Users trusted assets to a permissioned system with a human-controlled multisig at its core. A state-level adversary with unlimited patience and the resources to run a six-month cover operation targeted exactly that layer.
The ETH detail is also worth noting. The Drift hack originally drained a Solana-based protocol, but attackers immediately bridged assets to Ethereum and converted to ETH. That is the exploiter's own judgment about where to hold and launder a nine-figure stash. Ethereum's composable bridge infrastructure provides the liquidity depth that a laundering operation at this scale requires.
For context on how DPRK-linked groups operate at this scale, TFTC has covered ZachXBT's earlier investigation into Lazarus Group's laundering network in the wake of the Bybit compromise.
What Comes Next
The falsifiable thesis: if law enforcement successfully freezes and repatriates a meaningful share of the remaining ~$194M, not through the DFX recovery pool but as actual ETH returned to actual victims, the custodial-risk argument weakens materially. A successful Tornado Cash trace-and-freeze by OFAC or DOJ that results in real clawbacks would also change the calculus. At current trajectory, neither outcome looks probable.
Tornado Cash's privacy architecture, combined with DPRK jurisdictional immunity and the scale of the remaining balance, means the $194M is functionally moving toward irretrievable. The DFX recovery pool will grow slowly from exchange revenue. Victims who trusted a permissioned DeFi platform with nine-figure assets are likely looking at years of incremental partial recovery, if any.
Sources
- Drift Protocol Recovery Update, June 3, 2026 (UNC6862 attribution)
- Drift Protocol Updates (April post-mortem)
- DefiLlama Hacks Tracker
- Arkham Intelligence
- Lookonchain (@lookonchain on X), October 20, 2026 alert
Frequently Asked Questions
Can Tornado Cash transactions be traced or reversed?
Tornado Cash pools deposits from multiple addresses to obscure transaction trails, making full attribution extremely difficult. Analytics firms like Chainalysis and Elliptic have developed partial heuristics, and OFAC sanctioned Tornado Cash in 2022, making U.S.-person interaction with the protocol illegal. But practical trace-and-freeze of funds after they enter the mixer, particularly when controlled by a North Korean state actor operating outside U.S. jurisdiction, remains extremely limited. No meaningful clawback from a Tornado Cash deposit by a DPRK-linked group has been publicly confirmed to date.
What is UNC6862 and how does it connect to other North Korean hacking operations?
UNC6862 is a North Korean threat group identified by Mandiant in its forensic investigation of the Drift Protocol hack. Drift's official June 3 update states the group has "direct ties to other state-sponsored actors involved in similar attacks on other platforms." DPRK-linked cyber operations have been responsible for multiple nine-figure crypto heists in recent years, with the Lazarus Group among the most documented. These operations consistently target human governance layers and social trust rather than pure code vulnerabilities.
Is there any realistic path to recovery for Drift users?
The DFX recovery token mechanism gives affected users a claim on a pool that started at approximately $3.1M per reports at the time and grows via Drift exchange revenue and any funds actually recovered by law enforcement. Against approximately $295M in losses, the math is punishing. With ~$194M still in exploiter-controlled wallets and law enforcement having reportedly frozen only ~$9.2M to date, the pool's growth from exchange revenue will be the primary recovery mechanism for the foreseeable future. Full restitution is not a realistic near-term scenario at current recovery rates.
