Drift: funds linked to the April attack moved to Tornado Cash

New movements rather than a new hack

Funds associated with the Drift attack moved again on 20 October 2026. Lookonchain reported the deposit of 25,700 ETH into Tornado Cash over approximately two hours, following two months of inactivity by the entity being tracked. This observation concerns the movement of assets already linked to the incident; it does not describe a new attack against the platform.

Tracking the subsequent transfers of these assets must remain separate from calculating the total losses caused by the original incident in April. Moving ether from an address to a mixing service does not create an additional theft of the same amount at every stage. Likewise, the dollar equivalent depends on the price used at the time of observation and does not necessarily equal the assets' value on the day of the attack.

Using a mixer makes matching deposits with withdrawals more difficult. However, it does not by itself establish that all traceability has disappeared or that the funds have been recovered by their owners. Address analyses remain observations to be compared with information from the investigation.

The original incident dates back to April

Drift links its compensation programme to losses from the incident on 1 April 2026. In its June update, the protocol said it had commissioned an independent analysis from Mandiant. Drift reports that this investigation attributed the attack to the North Korean group UNC6862. That particular attribution must therefore continue to be presented as the conclusion of this investigation.

The same communication described recovery work focused on protocol security, with stronger engineering and a review of risk mechanisms. The stated objective was to relaunch a platform capable of generating revenue to help repair the losses. A relaunch objective is not, in itself, proof of full reimbursement.

Following the case therefore requires distinguishing information about the suspected perpetrators, technical fixes and resources actually available to victims. Progress reported on one of these fronts does not mean that the questions concerning the other two have automatically been resolved at the same time.

DFX represents a claim within a recovery mechanism

On 1 October, Drift opened claims and redemptions for DFX tokens. The announced allocation is one token for each USDT of verified loss. This ratio determines the quantity allocated; it does not mean that a DFX can immediately be redeemed for one USDT.

The redemption amount depends on the recovery fund's balance relative to the remaining DFX supply. The documentation states that this fund may receive a portion of protocol revenue and recovered amounts. The launch figures therefore describe a dated situation rather than a permanent redemption value.

This separation is decisive when interpreting October's movements. A transfer observed going to Tornado Cash does not contribute to the compensation fund simply because it has been identified. For users affected by the original incident, monitoring must focus on assets actually returned, payments into the fund and the published redemption conditions. Watching stolen funds move and returning those funds to their owners remain two different stages of the process.