Drift Protocol exploiter sends $44.4M to Tornado Cash, ZachXBT walks away

Three months of silence ended abruptly when a wallet connected to the Drift Protocol exploit began moving funds again — and the destination was Tornado Cash. On July 23 and 24, the address transferred 23,095.1 ETH, worth roughly $44.4 million, into the Ethereum mixer in rapid-fire batches of 100 ETH, 10 ETH and 1 ETH. For investigators already stretched thin, the timing could not have been worse.

Key takeaways

• The Drift exploiter moved 23,095.1 ETH (~$44.4 million) into Tornado Cash after roughly three months of wallet inactivity.
• The same address sent 0.85 ETH to wallets labeled as Bybit deposit addresses during the transfer, according to Etherscan records.
• Independent investigator ZachXBT said he has no plans to keep tracking the funds, citing the resource demands of monitoring a nine-figure North Korea-linked theft.
• Mandiant attributed the original attack to UNC6862, a North Korean threat group that used social engineering rather than a smart contract flaw.
• Drift’s recovery framework pools any recovered funds for user claims and includes plans to issue recovery tokens, though the bounty program’s current status remains unclear.

Resumption of Fund Movements by the Drift Exploiter

Researcher JL, known on-chain as 0xJaelle, first flagged the movement and tagged ZachXBT for attention. On-chain records show the address labeled “Drift Exploiter 4” processed hundreds of transactions over two days. The pace was notable — Onchain Lens reported the attacker was sending 100 ETH batches into the Tornado Cash router several times per minute.

… Continue reading the full article at the original source below.