blockintAI · Research blog

Back to the Mixer: Drift's Hackers Push 25,710 ETH Into Tornado Cash, 16 Hours After the Aztec Connect Thief

BlockintAI · 2026-10-21T11:02:00.000Z

BlockintAI research. On-chain balances and transactions were re-checked on Tuesday, October 20, 2026, at 7:14 AM Central Time (CT), Ethereum block 26,233,728, using Etherscan data and a public Ethereum node. Times are CT unless marked UTC. Dollar values use an ETH price of about $2,380, the price Etherscan showed that morning, unless a source's own figure is quoted.

At 2:08 AM Central Time on Tuesday, October 20, 2026, an Ethereum wallet that had not sent a single transaction in 202 days sent its first one. It put 100 ETH into Tornado Cash, the Ethereum mixing service.

Then it did it again. And again. By 4:21 AM it had made 258 deposits, 257 of 100 ETH and one of 10 ETH, for a total of 25,710 ETH, about $61 million. The wallet had received that ETH on April 1, 2026, the day attackers drained Drift Protocol, a Solana trading platform, of what Drift puts at $295.7 million.

It wasn't the only old heist to wake up. Sixteen hours earlier, at 10:04 AM on Monday, October 19, the wallet behind the June 14 exploit of Aztec Connect, a retired Ethereum privacy rollup, started cashing in tokens it had sat on for 127 days. Fifteen minutes later everything was ETH, and by 10:45 AM 1,255.8 ETH had gone into the same mixer.

Two separate thefts, one destination. This is what the chain shows about both, and about what is still sitting in Drift's attacker wallets.

Key facts
Drift Protocol hack April 1, 2026, on Solana. Drift lists $295,706,374.93 in stolen tokens. Drift says the attackers spent about six months posing as a trading firm, and that Mandiant attributed the attack to UNC6862, a North Korean threat group
The four Ethereum wallets Received 130,261.6 ETH between 11:48 AM CT on April 1 and 2:49 AM CT on April 2, 2026. Drift named all four in an on-chain message on April 3. Etherscan tags them Drift Exploiter 1, 3, 4 and 5
July 23, 2026 Drift Exploiter 4 sent 23,095.1 ETH to Tornado Cash in 245 deposits, 1:55 AM to 3:53 AM CT
October 20, 2026 Drift Exploiter 5 sent 25,710 ETH to Tornado Cash in 258 deposits, 2:08 AM to 4:21 AM CT. It was the wallet's first outgoing transaction since the hack
Still unmoved Drift Exploiter 1 (24,881.98 ETH) and Drift Exploiter 3 (56,568.38 ETH): 81,450.36 ETH, about $194 million. Neither has ever sent a transaction (7:14 AM CT, Oct 20)
Aztec Connect exploit June 14, 2026: about $2.19 million drained in one transaction, per Aztec Labs. The attacker's wallet was funded through Tornado Cash three hours earlier
Aztec Connect, October 19 Yearn tokens redeemed and everything swapped to ETH, 10:04–10:19 AM CT. Then 30 deposits, 1,255.8 ETH, into Tornado Cash, 10:22–10:45 AM CT. 0.036 ETH left
Freezes and sanctions Every wallet here holds ETH, which no issuer can freeze. None of the addresses is on OFAC's sanctions list, and Treasury took Tornado Cash off the list in March 2025
BlockintAI report Aztec Connect attacker

A trading firm that wasn't

The Drift story starts six months before the money moved.

In an incident update summarized by CoinDesk on April 5, Drift said a group first approached its contributors at a major crypto conference in the fall of 2025, presenting itself as a quantitative trading firm. It was technically fluent and had verifiable professional backgrounds. Over the following months it set up a Telegram group, onboarded a vault on Drift, deposited more than $1 million of its own money and met Drift contributors in person at conferences in several countries.

By the time it struck, the relationship was nearly half a year old. Drift said the group compromised contributors' devices, one through a TestFlight app presented as the group's wallet product and one through a code-editor flaw that ran code when a file or folder was opened. That gave the attackers two of the five approvals on Drift's Security Council multisig.

Those approvals were signed as Solana "durable nonce" transactions, which don't expire. CoinDesk's April 2 analysis laid out how the attackers held them for more than a week and then, on April 1, used them to take over Drift's admin permissions and drain its vaults in minutes.

Drift's April 16 update lists $295,706,374.93 in stolen tokens, led by $159.3 million in JLP and $71.4 million in USDC. In its June 3 recovery update, Drift said Mandiant's forensic review "conclusively attributed the attack to UNC6862, a North Korean threat group." (CoinDesk's April 5 report on Drift's earlier update named UNC4736, also known as AppleJeus or Citrine Sleet. Drift's June statement is the later one.)

The long con is the part worth sitting with. It is the same move that powers the romance and investment scams BlockintAI tracks every day, scaled up: months of patient trust-building before anyone asks for money.

From Solana to four Ethereum wallets

Most of the loot didn't stay on Solana. Our on-chain review of one receiving address shows how fast it moved.

Between 11:27 AM and 12:38 PM CT on April 1, the Ethereum address 0xFcC47866Bd2BD3066696662dbd1C89c882105643 received 64,043,456.73 USDC in 20 transfers minted through the contract Etherscan tags "Circle CCTP: Message Transmitter V2," Circle's own bridge for moving USDC between chains. Within the hour it swapped the USDC for ETH through swap contracts Etherscan tags "DODO: Fee Route Proxy" and "CoW Protocol: GPv2Settlement," and started paying the ETH out.

Converting to ETH matters. Circle can freeze USDC at an address. Nobody can freeze ETH.

By 2:49 AM CT on April 2, four wallets held 130,261.6 ETH between them:

Wallet (Etherscan tag) Address ETH received, April 1–2 (transfers over 0.1 ETH) Since then
Drift Exploiter 1 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7 24,881.97 Never sent a transaction
Drift Exploiter 3 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 56,568.32 Never sent a transaction
Drift Exploiter 4 0xbDdAE987FEe930910fCC5aa403D5688fB440561B 23,096.63 23,095.1 ETH to Tornado Cash, July 23
Drift Exploiter 5 0xAa843eD65C1f061F111B5289169731351c5e57C1 25,714.69 25,710 ETH to Tornado Cash, October 20

The four-wallet list doesn't rest on explorer tags alone. At 12:17 AM CT on April 3, an address Etherscan tags "Drift: Team Wallet" sent each of the four a message written into the transaction data:

"Critical information of parties related to the exploit have been identified. Drift is now sending an on-chain message from 0x0934faC45f2883dd5906d09aCfFdb5D18aAdC105 to the ETH Wallets that holds the stolen funds." … "We are ready to speak. Please reach out via Blockscan chat."

The message lists the same four addresses as the table above. None of the four has ever answered on-chain.

Plenty of strangers wrote to them instead. By this morning the four wallets had collected 95 on-chain messages from 19 addresses, Drift's included: pleas for a single ETH, a demand for 1,000 ETH within 12 hours or the sender would hand over the attackers' "data," offers to help launder the money, and messages from people who said they had lost money on Drift asking for it back. At 4:46 AM CT on October 20, 25 minutes after Drift Exploiter 5's last deposit, the same address that had asked the Aztec Connect thief the day before for "couple of grand" sent three of Drift's wallets the identical request.

The same routine, 89 days apart

The two Drift wallets that have moved did it the same way, at the same time of night.

July 23, 2026 October 20, 2026
Wallet Drift Exploiter 4 Drift Exploiter 5
First deposit (CT) 1:54:59 AM 2:08:35 AM
Last deposit (CT) 3:52:35 AM 4:21:35 AM
Deposits 245 258
Pool sizes 230 × 100 ETH, 9 × 10, 5 × 1, 1 × 0.1 257 × 100 ETH, 1 × 10
Total into Tornado Cash 23,095.1 ETH 25,710 ETH
Left in the wallet afterward 0.004 ETH 3.98 ETH

Every deposit went through the contract Etherscan tags "Tornado.Cash: Router," which forwards each deposit into a fixed-size pool. Both runs started around 2 AM Central Time and took about two hours. Each wallet was all but emptied in one sitting after holding its ETH untouched since April 1: 113 days for Exploiter 4, 202 days for Exploiter 5. After the July run, Exploiter 4 also sent four small payments, 0.85 ETH in all, to four other addresses.

Trackers spotted today's run while it was under way. PeckShieldAlert posted at 3:54 AM CT that "~21.3K ETH (~$50M)" had gone in so far, and Lookonchain counted 25,700 ETH at 4:25 AM CT. Both described the run as ending "2 months of inactivity." On-chain, the previous Drift wallet to move was Exploiter 4, 89 days earlier, and Exploiter 5 itself had never sent a transaction.

What happens next is harder to see. Tornado Cash breaks the link between a deposit and a withdrawal. Anyone holding a deposit's secret note can withdraw to a brand-new address, at any time. After this morning's run, the contract Etherscan tags "Tornado.Cash: 100 ETH" held 252,400 ETH. The 25,700 ETH that Drift Exploiter 5 put into that pool is about a tenth of it.

What is left, and who can stop it

At 7:14 AM CT on October 20, the two Drift wallets that have never moved held:

  • Drift Exploiter 3: 56,568.38 ETH
  • Drift Exploiter 1: 24,881.98 ETH

That is 81,450.36 ETH, about $194 million. Lookonchain's 4:25 AM count, 81,864 ETH, is close to ours.

All of it is ETH. Tether and Circle can freeze USDT and USDC at an address, and they have done so after other hacks. Neither has anything to freeze here: our reads of both contracts at 7:17 AM CT found no USDC and at most 11 cents of USDT in any of the four wallets, and none of them on either blacklist. None of the addresses in this post is on the U.S. Treasury's Specially Designated Nationals (SDN) list. Treasury lifted its sanctions on Tornado Cash on March 21, 2025. Tornado Cash co-founder Roman Semenov is still on the list.

The pattern so far has been one wallet at a time, in one overnight session, months apart. Nothing guarantees the next one waits that long.

Meanwhile, the victims

Drift has spent the months since April rebuilding. On October 1 it opened claims for DFX, a recovery token: one DFX for every verified dollar (USDT) of loss, 299,500,810.998 tokens in all. Holders can redeem DFX against a recovery pool that held about 3.1 million USDT at launch, about 1 cent per token. The pool is funded from a share of the relaunched exchange's revenue. Drift says Tether has committed up to 127.5 million USDT to support the relaunch and user recovery, and other partners up to 20 million USDT.

Drift's DFX page says any stolen funds "recovered through a freeze, the bounty, or law enforcement" go into the same pool. Every run through the mixer puts that source of money further out of reach.

Sixteen hours earlier: the Aztec Connect thief

Aztec Connect was a privacy rollup on Ethereum that Aztec Labs retired in 2023. In April 2024 Aztec Labs gave up all control of the contracts, so that users could still withdraw on their own. Some funds were still in them two years later.

According to Aztec Labs' write-up, on June 14, 2026 an attacker found a gap between the rollup's proof and its settlement code. The proof checked every row in a batch, but the settlement contract only acted on the number of rows the batch declared real, so a row could create balance inside the rollup without any deposit ever being collected. The attacker sent 14 crafted batches in a single transaction and withdrew about $2.19 million.

The chain shows that the attacker's wallet, 0x0F18D8b44a740272f0be4d08338d2b165b7EdD17, which Etherscan tags "Aztec Exploiter 1," was funded at 4:26 AM CT on June 14 with 0.0979 ETH out of the contract Etherscan tags "Tornado.Cash: 0.1 ETH." The exploit transaction followed at 7:26 AM CT and paid the wallet 908.99 ETH, 270,513 DAI, 167.89 wstETH, 9,273.73 LUSD and three Yearn vault tokens.

Then the wallet went quiet for 127 days. On October 19, it moved:

  • 10:04–10:06 AM CT: redeemed its three Yearn vault tokens for 443.84 LUSD, 6,011.93 DAI and 18.72 WETH.
  • 10:08–10:19 AM CT: swapped 9,717.57 LUSD and 167.89 wstETH for 213.31 ETH through the contract Etherscan tags "KyberSwap: Meta Aggregation Router v2," and 276,524.99 DAI and the WETH for 133.45 ETH through the contract it tags "Velora: Augustus V6.2."
  • 10:22–10:45 AM CT: sent 30 deposits through the Tornado Cash router: 12 of 100 ETH, 5 of 10, 5 of 1 and 8 of 0.1, for 1,255.8 ETH, about $3 million.

It kept 0.036 ETH. The money came in through Tornado Cash in June and went back out through it in October.

The public alerts came that evening. CertiK Alert flagged the 1,255.8 ETH at 8:44 PM CT and PeckShieldAlert at 9:39 PM CT, 10 to 11 hours after the last deposit. CertiK's follow-up post described a flaw in Aztec 2.0's escape-hatch circuit. That is a separate incident: Aztec Labs says Aztec 2.0, an older retired rollup, was drained on June 17, 2026, by a different attacker wallet. Our on-chain review identified the depositing wallet as the Aztec Connect attacker from June 14: it is the wallet Aztec Labs' own write-up names (0x0F18…EdD17), and the June 14 exploit transaction paid it directly.

What both trails say

  • Waiting is part of the plan. Both thieves sat on their loot for months, through the period when alerts and attention are highest, then moved in a single sitting.
  • Converting early puts money out of reach of a freeze. Drift's USDC, which Circle can freeze, became ETH within hours of the hack. Aztec Connect's loot was ETH and tokens like DAI and wstETH that no issuer can freeze.
  • Retired contracts still hold money. Aztec Connect was shut down three years before it was drained. If you still have funds in a protocol that has been sunset, use its exit route.
  • Trust takes months to fake, and it works. Drift's attackers built a real business relationship before they asked for anything. Teams should treat every device that touches a multisig as a target, verify what they sign outside the signing screen, and add delays to admin actions.
  • Ignore "recovery" offers. Anyone who contacts you offering to get money back out of Tornado Cash for a fee is running the next scam. For Drift losses, use only Drift's official claim process.
  • Report it. In the U.S., report hacks and fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. If you've been hacked or scammed, you can also file a report at blockint.ai with the addresses and transaction IDs. It's free, and anonymous reports are accepted.

#Drift #TornadoCash #DeFi #CryptoHack #Ethereum

Sources

Drift Protocol

Drift on-chain (Ethereum; Etherscan public name tags as shown on Oct 20, 2026)

Aztec Connect

Freezes and sanctions