Drift Protocol hack: a second 25,710 ETH went into Tornado Cash on 20 October, and 56,568 ETH still sit on one wallet

Drift lost the money without a smart-contract bug. According to Drift’s own account, summarised by Nexus Mutual, the attackers spent months posing as a trading firm, compromised contributors’ devices, and obtained pre-signed approvals from two of the five Security Council signers. On 1 April they listed a token they had created themselves, CVT, as collateral, raised the withdrawal limits and emptied the vaults: JLP, USDC, cbBTC and smaller assets, about $285 million. TRM Labs and Elliptic attribute the attack to a North Korean state-linked group (UNC4736, also tracked as AppleJeus and Citrine Sleet). That attribution is theirs; the chain cannot confirm who is behind a key.

On 23–24 July PeckShield and Lookonchain reported that a wallet labelled “Drift Exploiter” had deposited 23,095 ETH into Tornado Cash. We read the attacker’s Ethereum wallets on 20 October 2026. Below is what the chain shows.

The stolen USDC crossed from Solana through Circle’s own bridge, CCTP: on Ethereum, Circle’s message contract 0x81D40F21F12A8F0E3252Bccb954D722d4c464B64 minted fresh USDC straight to the attacker’s wallets. We count 186.7 million USDC minted this way on 1–2 April to six of them, mostly 0xFcC47866Bd2BD3066696662dbd1C89c882105643 (64.0M), 0xAD383d6b3886b598F48c625437ccB4f8E84dBB48 (65.4M) and 0xeF4326F42f2eB656C58fabf8B1D3298DC2Ab80C6 (53.8M). Another 4.0 million USDC came through Mayan to 0xeC3145C5F138baF26722F1f909f6189Ce81680FB, and about 7,240 ETH arrived through Mayan as ether to 0xb2C6B5535Cbe45556b4f43Bc2eCAe3d56fb740a9 and 0x3C48A6938998F6cbc0a94f5f580990C554263Fb2.

Reports speak of about $232 million bridged. The 190.7 million we can tie to these wallets leave a gap of about $41 million that we have not attributed: other large CCTP recipients that day may belong to the attacker, but we could not prove a link.

Each wallet sold its USDC for ether within hours, through CoW Protocol, DODO, Uniswap, Kyber, Magpie and 0x. Then the ether was gathered on three wallets.

0xbDdAE987FEe930910fCC5aa403D5688fB440561B collected 23,097 ETH on 1 April and sat on it for 113 days. On 23 July, in two hours, it sent 23,095 ETH into Tornado Cash through the router 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b, almost all in 100 ETH deposits. This is the wave already in the press.

0xAa843eD65C1f061F111B5289169731351c5e57C1 collected 25,715 ETH on 1 April, mostly from 0xFcC47866Bd2BD3066696662dbd1C89c882105643, and waited 202 days. On 20 October, between 07:08 and 09:21 UTC, it made 257 deposits of 100 ETH and one of 10 ETH: 25,710 ETH. About 4 ETH is left on it. We found no report of this wave.

0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 collected 56,568 ETH on 1–2 April from 0xAD383d6b3886b598F48c625437ccB4f8E84dBB48, 0xeF4326F42f2eB656C58fabf8B1D3298DC2Ab80C6 and 0xF6fD4dB0C5930A8D0e5F9C850361F7dbe695BdEE, and has never sent anything. At today’s price that is about $138 million, roughly half of what was stolen.

If the pattern holds, the parked wallet is the next to go into Tornado. We are watching it.

Across both waves the attacker deposited 48,805 ETH: 48,700 into the 100 ETH pool, 100 into the 10 ETH pool and a few into the smaller pools. The October wave alone is 257 deposits of 100 ETH in two hours and thirteen minutes. This matters for anyone who receives a 100 ETH withdrawal in the weeks after: 48,700 ETH from one theft is about a tenth of everything deposited into that pool in 2026.

Withdrawals cannot be matched to deposits from the pool’s own data, and we do not claim any withdrawal as the attacker’s.

Circle added 0xeC3145C5F138baF26722F1f909f6189Ce81680FB to the USDC blacklist on 15 April 2026 (block 24,888,079). By then the wallet held no USDC: all 3,998,399 had been sold for ether on 1 April. We checked the balance at the block before and at the block of the blacklisting: zero. The stolen value on Ethereum has been in ether, which no issuer can freeze, since the first evening.

The attacker’s history is full of transfers that are not the attacker’s: zero-value transfers, USDT dust and fake “ETH” tokens from addresses that start and end like its real wallets (0xbdda…561b, 0xaa84…). This is address poisoning, aimed at anyone who copies an address from that history. Those addresses are not part of the theft and are not on this page.

We filed all 13 wallets below in our database as part of the Drift Protocol exploit; each now scores 90–100. The address check shows them as high risk, and the risk spreads to wallets that receive from them.

We added 0x0FE3b6908318B1F630daa5B31B49a15fC5F6B674 and 0xAa843eD65C1f061F111B5289169731351c5e57C1 to our watchlist and will update this page if the ether moves.

To check an address yourself, use the address check.

It does not name a person, and the attribution to a North Korean group is TRM Labs’ and Elliptic’s, not ours. It does not say that Circle, Mayan, CoW Protocol, DODO, Uniswap, Kyber, Magpie or 0x did anything wrong, and it does not claim any Tornado Cash withdrawal as the attacker’s. The attack, the $285M total and the July wave were reported first by others; the full Ethereum cluster, the 20 October wave, the parked wallet and the empty freeze are ours, read on 20 October 2026.