{"id":7477,"date":"2026-10-20T13:05:27","date_gmt":"2026-10-20T13:05:27","guid":{"rendered":"https:\/\/tokenmetrics.com\/blog\/drift-exploiter-sends-61m-eth-tornado-cash-holds-194m\/"},"modified":"2026-10-20T13:05:27","modified_gmt":"2026-10-20T13:05:27","slug":"drift-exploiter-sends-61m-eth-tornado-cash-holds-194m","status":"publish","type":"post","link":"https:\/\/tokenmetrics.com\/drift\/news\/drift-exploiter-sends-61m-eth-tornado-cash-holds-194m\/","title":{"rendered":"Drift Hacker Moves $61M to Tornado Cash as Solana Technicals Read Bearish"},"content":{"rendered":"<p>A dormant hacker wallet woke up and moved $61 million. That changes the recovery math.<\/p>\n<h2>Signal Snapshot<\/h2>\n<ul>\n<li>Actor: a wallet linked to the Drift Protocol hack. It woke after two months quiet.<\/li>\n<li>Event: it sent 25,700 ETH to Tornado Cash over two hours on Tuesday.<\/li>\n<li>Size: the move was worth about $61 million. The wallet still holds about 81,454 ETH.<\/li>\n<li>Market read: Token Metrics technicals read bearish on SOL. Price sits around $104.<\/li>\n<li>Sentiment: fear for victims. Mixer moves often mean cashing out is near.<\/li>\n<li>Top risk: the rest of the $194 million could move next. That would hurt recovery hopes.<\/li>\n<\/ul>\n<h2>Key Takeaways<\/h2>\n<ul>\n<li>What happened: the Drift exploiter sent about $61 million in ETH to Tornado Cash.<\/li>\n<li>Why it matters: mixer deposits make tracing harder and cut odds of fund recovery.<\/li>\n<li>The real investor read: this is a security event, not a Solana outage. Watch flows, not hype.<\/li>\n<\/ul>\n<h2>What Happened<\/h2>\n<p>Drift is a Solana-based decentralized exchange. It reported about $295 million in losses from the April 1 hack.<\/p>\n<p>The attacker wallet had sat still for two months. Then it moved fast on Tuesday.<\/p>\n<p>It sent 25,700 ETH to Tornado Cash over two hours. Lookonchain flagged the move in an X post.<\/p>\n<p>Tornado Cash pools funds from many users. It hides the trail between sender and receiver.<\/p>\n<p>The wallet still holds a lot. Arkham data puts the balance near 81,454 ETH worth roughly $194 million.<\/p>\n<p>In June, Drift said Mandiant blamed the attack on UNC6862. That is a North Korean threat group.<\/p>\n<p>Drift opened claims for DFX recovery tokens on Oct. 1. The tokens give victims a claim on a recovery pool.<\/p>\n<p>That pool held about $3.1 million at launch. It gets exchange revenue plus any recovered funds.<\/p>\n<p>The <a href=\"https:\/\/cointelegraph.com\/news\/drift-exploiter-eth-tornado-cash?utm_source=rss_feed&amp;utm_medium=rss&amp;utm_campaign=rss_partner_inbound\" target=\"_blank\" rel=\"noopener\">cryptocurrency mixer over two hours<\/a> shows how fast dormant funds can move. Two quiet months ended in one morning.<\/p>\n<p>The case now ranks as the <a href=\"https:\/\/cointelegraph.com\/news\/drift-exploiter-eth-tornado-cash?utm_source=rss_feed&amp;utm_medium=rss&amp;utm_campaign=rss_partner_inbound\" target=\"_blank\" rel=\"noopener\">third largest hack of 2026<\/a> per DefiLlama. Bigger cases include the $387 million Bitget hack and the $320 million Liquid Network exploit.<\/p>\n<h2>Why It Matters<\/h2>\n<p>This is a security event with market structure fallout. It tests trust in on-chain trading venues.<\/p>\n<p>First, mixers change the game. Once funds enter Tornado Cash, tracing gets much harder.<\/p>\n<p>Second, size matters. A $61 million move is large. A $194 million overhang is larger.<\/p>\n<p>Third, recovery math is brutal. A $3.1 million pool cannot cover $295 million in losses.<\/p>\n<p>That gap shapes sentiment. Victims hold DFX claims. The pool needs revenue or seized funds to grow.<\/p>\n<p>For investors, the read is simple. This is not about Solana speed or fees. It is about exploit risk.<\/p>\n<p>For builders, the lesson is clear. One April breach still drives headlines in October.<\/p>\n<p>For exchanges, this strengthens the case for better custody and monitoring. The crypto rail at stake here is exchanges. Spot trading needs safe settlement or users leave.<\/p>\n<p>Second-order take: large mixer deposits often come before selling. Selling could pressure ETH liquidity in short bursts. That does not mean a market crash. It means watch large inflows to mixers and then to trading venues.<\/p>\n<p>What would make this matter less? A freeze or seizure of funds. A white-hat deal. A confirmed return. Any of those would change the read fast. Without that, the headline is signal, not noise.<\/p>\n<h2>Token Metrics View<\/h2>\n\n<p>Token Metrics data covers SOL as the network asset behind Drift. Price sits around $104. It is down about 1% on the day.<\/p>\n<p>The trend just flipped bearish. Momentum sits in the middle. It is not weak. It is not stretched.<\/p>\n<p>Volatility is running warm at near 4% daily range. The market is starting to trend firmly. Price is trading sideways inside its recent range. It sits in the middle of that range.<\/p>\n<p>First support sits near $95. Next resistance sits near $119. That band frames the next move.<\/p>\n<p>Smart-money flow is not in this snapshot. So price action carries more weight this week.<\/p>\n<p>The fresh catalyst is Solana Alpenglow. It is set to go live on Oct. 21 in about 1 day. It aims to make finality much faster.<\/p>\n<p>That timing matters. A network upgrade during exploit headlines splits attention. Tech progress and security fears trade side by side.<\/p>\n<p>Polymarket traders are calm on downside. A contract asking if Solana dips to $60 in October is priced near 1%. You can see it in <a href=\"https:\/\/polymarket.com\/market\/will-solana-dip-to-60-in-october-2026\" target=\"_blank\" rel=\"noopener\">a Polymarket contract on the deadline<\/a>. That strike sits about $44 below current price.<\/p>\n<p>Daily Pulse tags this as a market snapshot. That fits. The story is flows and sentiment, not a chain halt.<\/p>\n<p>For holders, the setup is two-sided. Bearish trend plus firm direction warns of downside drift. A clean upgrade plus calm prediction markets leans against panic. Watch the $95 level and the $119 level for clues.<\/p>\n\n\n<h2>Market Context<\/h2>\n<p>This story fits in security and sentiment. It is also about exchanges and trust.<\/p>\n<p>Crypto hacks follow a pattern. Breach first. Quiet holding next. Mixer moves later. Then slow selling or laundering.<\/p>\n<p>Two months of quiet fits that pattern. Tuesday broke the quiet.<\/p>\n<p>The scale puts it in the top tier for 2026. DefiLlama ranks it third this year. The Bitget case at $387 million and the Liquid Network case at $320 million sit above it.<\/p>\n<p>Attribution adds weight. Mandiant tied the April attack to UNC6862. That links it to North Korean threat activity.<\/p>\n<p>That detail matters for policy. State-linked hacks draw more focus from law enforcement. They also face more sanctions risk on downstream addresses.<\/p>\n<p>The DFX plan mirrors past recovery tokens. Victims get a claim, not cash. The pool grows only if revenue grows or funds return.<\/p>\n<p>With $3.1 million at start against $295 million lost, payouts will be slow. That is math, not opinion.<\/p>\n<p>No historical analogs were supplied in inputs. So we do not force a past comparison here. The present facts carry the story.<\/p>\n<p>Why now? The mixer move re-lit an old hack. Dormant wallets waking often reset the news cycle. Traders who forgot April must price it again.<\/p>\n<h2>Risks to Watch<\/h2>\n<p>Watch for more mixer deposits. The wallet still holds about 81,454 ETH. Another tranche would signal intent to keep laundering.<\/p>\n<p>Watch for exchange inflows tied to fresh Tornado Cash withdrawals. That often marks the selling stage.<\/p>\n<p>Watch for sanctions flags. Mixer funds can taint downstream addresses. Venues may freeze related deposits.<\/p>\n<p>Watch for DFX price swings. Thin recovery tokens can move fast on headlines. Low liquidity cuts both ways.<\/p>\n<p>Watch for copycat fear. Large hacks can spur withdrawals from similar trading venues. Proof of reserves and audit posts can calm nerves.<\/p>\n<p>What would contain risk? A confirmed freeze by issuers or venues. A law enforcement seizure notice. A pause in wallet movement for weeks.<\/p>\n<p>What would make risk worse? Rapid splitting across new wallets. Bridging to other chains. Use of over-the-counter desks after mixing.<\/p>\n<h2>What to Watch Next<\/h2>\n<ul>\n<li>Watch the exploiter balance on Arkham. Does the 81,454 ETH figure fall in the next seven days?<\/li>\n<li>Watch Tornado Cash flows. Do more deposits land from linked addresses this week?<\/li>\n<li>Watch Drift DFX claims portal. Do claims rise after Oct. 1 and does the $3.1 million pool grow?<\/li>\n<li>Watch Solana Alpenglow on Oct. 21. Does finality improve without network issues?<\/li>\n<li>Watch SOL near $95 and near $119. A break either way will set the short-term tone.<\/li>\n<\/ul>\n<p>This is for info only. It is not financial advice. Do your own work and size risk with care.<\/p>\n<h2>Sources \/ Data Used<\/h2>\n<ul>\n<li><a href=\"https:\/\/cointelegraph.com\/news\/drift-exploiter-eth-tornado-cash?utm_source=rss_feed&amp;utm_medium=rss&amp;utm_campaign=rss_partner_inbound\" target=\"_blank\" rel=\"noopener\">drift exploiter sends $61M ETH<\/a><\/li>\n<li>Token Metrics data used: SOL spot price and 24h and 7d move, market cap, plain-English technicals, support and resistance levels, Alpenglow catalyst, Polymarket downside odds, Daily Pulse classification.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"A wallet tied to the $295 million Drift hack sent 25,700 ETH to Tornado Cash after two quiet months. It still holds about 81,454 ETH worth roughly $194 million.","protected":false},"author":1,"featured_media":7475,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_tm_paid_cta_tier":"","_tm_paid_cta_heading":"","_tm_paid_cta_body":"","csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_reading_time":"","csco_page_toc_navigation":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"csco_post_video_bg_volume":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1295,158],"tags":[208,44,32,283,149],"sections":[183],"entities":[1297],"class_list":["post-7477","post","type-post","status-publish","format-standard","has-post-thumbnail","category-drift","category-news","tag-defi","tag-drift","tag-ethereum","tag-security","tag-solana","section-news","entity-drift","cs-entry","cs-video-wrap"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/10\/drift-exploiter-sends-61m-eth-tornado-cash-holds-194m-featured.webp","_links":{"self":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/7477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/comments?post=7477"}],"version-history":[{"count":0,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/7477\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/media\/7475"}],"wp:attachment":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/media?parent=7477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/categories?post=7477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/tags?post=7477"},{"taxonomy":"section","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/sections?post=7477"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/entities?post=7477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}