Wallets related to the Drift protocol theft on April 1st deposited approximately 25,700 Ethereum, worth about $61.56 million, into the crypto mixer Tornado Cash within about two hours on Tuesday. There was no activity from these addresses for about two months prior to that.
The transfer data of Arkham Intelligence shows that these deposits were made in batches, with each transaction typically involving 100 ETH, which is approximately equivalent to 237,800 US dollars. There were also smaller batches of 10 ETH each. These amounts match the fixed deposit pool of the coin mixer, and users will later be able to withdraw funds from the new addresses, thereby severing the public link between the sender and the recipient.
On the entity page for Arkham, it was shown that 71 addresses related to the attacker still held 81,454 ETH after this round of deposits on Tuesday, which is approximately equivalent to 198.58 million US dollars at current prices. In addition to this amount of ETH, these wallets also held about 561,600 US dollars in other tokens, including USDT, USDC, Solana, and USDY.
The deposits on Tuesday occurred after the first round of transfers on July 23rd and 24th. At that time, an address labeled Drift Exploiter4 sent approximately 23,095 ETH to the same mixer, which was worth about 44.4 million US dollars at that time.
The attack on April 1st occurred in the Drift vault located at Solana. After obtaining administrator privileges, the attacker added a fake token and used it to borrow real liquidity. Upon splitting the Drift's own assets, the total amount of stolen funds amounted to 295.7 million US dollars, of which 159.3 million US dollars were in the form of JLP —– Jupiter liquidity provider tokens –– and 71.4 million US dollars in USDC. A large portion of this money was later exchanged and bridged to Ethereum.
The portfolio view of Arkham is still displayed, and among the assets held by the attacker, there is only 1 Fartcoin, valued at approximately 0.15 US dollars, which is far lower than the $4.1 million Fartcoin that Drift claimed to have been stolen in April.
Drift stated in April that this attack was a six-month-long operation. The involved gang disguised themselves as a quantitative trading company, met with contributors offline, and invested $1 million of their own funds to build trust. In June, Drift reported that the forensic company Mandiant attributed this attack to UNC6862, a North Korean threat organization.
The restarted exchange formerly known as Drift is now operated under the name of Velocity. On October 1st, the company reopened the application process for DFX tokens. The company distributed 1 token for every $1 of verified losses, totaling approximately 299.5 million tokens. When the recovery pool was launched, it contained around 3.1 million USDT tokens. Therefore, early redeemers received a return of about 0.0104 USDT per token, which means they recovered roughly 1 cent for every $1 lost.
This pool can earn 60% to 90% of the net protocol income of Velocity per day, with the proportion increasing as daily revenue grows; Tether also commits to providing up to 127.5 million USDT for restart and recovery plans. Any stolen funds recovered through freezing, rewards, or law enforcement actions will also be added to this pool.
