Drift Hacker Moves $63 Million in Ethereum Through Tornado Cash
by Maisie Morrison · BlockonomiTLDR
Table of Contents
- A wallet tied to the April Drift hack sent 25,710 ETH, worth about $63.1 million, into Tornado Cash on Oct. 20.
- The wallet made 258 deposits over two hours and 13 minutes, leaving about 3.98 ETH behind.
- Drift estimated about $280 million was taken in the April 1 attack, which Mandiant linked to North Korean group UNC6862.
- Drift opened DFX token claims on Oct. 1, giving users one DFX for each USDT of verified loss.
- As of Oct. 4, the redemption quote was about 0.0104 USDT per DFX, close to one cent per USDT lost.
A wallet tied to the April hack of crypto trading protocol Drift sent 25,710 ETH into the Tornado Cash mixer on Oct. 20. The transfers were worth about $63.1 million.
The address is labeled “Drift Exploiter 5” on the blockchain explorer Etherscan. The deposits were the wallet’s first outgoing Ethereum transactions, and they left it nearly empty.
How the Transfers Happened
The wallet made 258 deposits to the Tornado Cash router. It sent 257 deposits of 100 ETH each, followed by one final deposit of 10 ETH.
The first deposit was confirmed at 07:08:35 UTC in block 26,232,203. The last came at 09:21:35 UTC in block 26,232,865. The full sequence took two hours and 13 minutes.
After the transfers, the address held about 3.98 ETH. The dollar value of the deposits is based on an average Ethereum price of $2,450 on Oct. 20.
On-chain analysis account Lookonchain separately reported that the exploiter wallets it tracks hold a combined 81,864 ETH.
Drift was attacked on April 1, more than six months before these transfers. In an April 2 disclosure, the protocol estimated that about $280 million had been withdrawn.
Drift said the attacker took over the administrative powers of its Security Council. The attacker used durable nonce accounts to pre-sign transactions and delay when they were carried out.
According to Drift, this allowed the attacker to get unauthorized or misrepresented transaction approvals in advance. At the time, the protocol said it had not found a bug in its programs or smart contracts.
In a June 4 update, Drift said the investigation it hired Mandiant to carry out linked the attack to UNC6862. That is a North Korean threat group.
How Drift Plans to Repay Users
Drift has set up a Recovery Pool to return funds to affected users. Money recovered through freezes, a bounty, or law enforcement goes into the pool. A share of the platform’s net protocol revenue is also added.
The protocol opened claims and redemptions for its DFX token on Oct. 1. Users receive one DFX for each USDT of verified loss.
Holders can trade their DFX for USDT at the quoted redemption amount. The tokens they submit are burned in the same transaction.
Users who redeem give up their share of future pool deposits for those tokens. Those who redeem only part of their holdings keep that share for the DFX they hold onto.
As of Oct. 4, the quote was about 0.0104 USDT per DFX. That is close to one cent per USDT lost.
In an April 16 update, Drift proposed up to $127.5 million from Tether and $20 million from other partners. The plan included a revenue-linked credit facility, an ecosystem grant, and market-maker loans.
The Oct. 20 deposits show where this wallet’s ETH went. How much of the stolen money will return to the Recovery Pool is still unknown. Ethereum was last trading at $2,462.20, up 3.55% over the past 24 hours.