Recent Transactions by Exploiter

In a significant turn of events related to the $295 million exploit of Drift Protocol that occurred on April 1, wallets associated with the attacker have transferred 25,700 Ethereum (ETH), approximately valued at $61.56 million, into the cryptocurrency mixer Tornado Cash. This transaction took place over a period of just two hours on Tuesday.

Data from Arkham Intelligence indicates that these wallets, which had been inactive for a span of about two months prior to this activity, executed the deposits in multiple batches, including 100 ETH transactions and smaller ones of 10 ETH. This method aligns with the structure of Tornado Cash, allowing for decentralized fund withdrawals that obscure the original source.

Current Holdings of the Attacker

Arkham also reports that there are still 81,454 ETH—converted to approximately $198 million—held within the exploiter’s 71 identified wallets after the recent transaction. Additionally, these wallets are reported to contain about $561,600 in various other cryptocurrencies such as USDT, USDC, and Solana.

This recent activity follows a prior round of transactions conducted on July 23 and 24, during which approximately 23,095 ETH (valued around $44.4 million at that time) was sent to the same mixer.

Background of the Exploit

The exploit against Drift Protocol, which targeted funds within their Solana vaults, involved the attacker exploiting admin privileges to introduce a counterfeit token that enabled the extraction of actual liquidity. The asset breakdown provided by Drift indicates that the total loss amounted to $295.7 million, comprising $159.3 million in Jupiter Liquidity Provider (JLP) tokens and $71.4 million in USDC. A substantial portion of these assets was subsequently swapped and bridged to the Ethereum network.

Interestingly, the exploiter’s holdings include a mere one Fartcoin, currently valued at approximately 15 cents. This stands in stark contrast to the $4.1 million worth of Fartcoin that Drift had stated was taken during the exploit.

Recovery Efforts

Following the exploit, Drift, which has since relaunched as Velocity, initiated claims for its recovery token (DFX) starting October 1. Each DFX token corresponds to losses in USDT, with a total potential claim amounting to around 299.5 million. Initially, the recovery pool had about 3.1 million USDT available, translating to early claim payouts of about 1.04 cents per dollar lost.

The recovery pool will receive a daily percentage of Velocity’s net revenue, ranging from 60% to 90%, with increments as earnings increase. Furthermore, Tether has pledged up to $127.5 million in USDT to assist with recovery efforts. Any recovered funds from asset freezes or law enforcement actions will also contribute to this pool.

Final Observations

The exploit has drawn attention to the vulnerabilities within cryptocurrencies and the significant impact of attacks on protocols. The incident has emphasized the importance of security measures as well as the rapid pace of recovery efforts to rebuild trust among investors and users.