After two months of silence, the hacker behind one of crypto’s largest thefts just began moving tens of millions through a mixer, and the clock is ticking on whether any of it can ever be traced back.This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
The hacker behind the $270 million theft from the Drift Protocol is moving again. According to blockchain tracker Lookonchain, the hacker sent 25,700 ETH (CRYPTO:ETH), valued at $61.6 million, to Tornado Cash in two hours after two months of silence.
Tornado Cash is a crypto mixer that blends users’ coins together, making it hard to trace which coins belong to whom. The hacker still holds 81,864 ETH, worth about $195 million at current prices, suggesting this could be the start of a larger laundering effort.
Currently, Ethereum is trading at around $2,382, down 1.7% in the last 24 hours and 9.5% over the past month. Once stolen crypto is sent through a mixer, can it ever be recovered?
North Korean Hackers Spent Six Months Setting Up the Drift Theft
Owlie Productions / Shutterstock.com
Drift is a decentralized exchange on the Solana (CRYPTO:SOL) blockchain that lets users trade crypto directly without an intermediary. On April 1, attackers exploited the platform, and Drift confirmed they used pre-signed durable nonce transactions and social engineering tactics. A durable nonce allows someone to sign a transaction now and process it later. While this is useful for genuine users, it poses risks if someone is manipulated into signing.
On April 5, Drift revealed that the exploit was part of a six-month operation conducted by North Korean intelligence. The hackers posed as a quantitative trading firm, interacted with Drift contributors at conferences, and invested over $1 million of their own money to gain trust. Investigators linked the attack to a group known as UNC4736, also called AppleJeus or Citrine Sleet.
The attackers compromised the contributors’ devices and obtained the approvals needed for multisig transactions. A multisig wallet usually requires several signatories to authorize any transfer, so deceiving the signers voided that security measure. According to TRM Labs, the theft took roughly 12 minutes, and the thieves swiftly moved the stolen funds to Ethereum, which is why they now move as ETH.
TRM Labs also found that Drift’s security measures failed because of a zero-timelock Security Council migration. A timelock enforces a mandatory waiting period before executing administrative changes, giving users time to respond before a potential theft.
ETH Barely Moved on the Tornado Cash Deposits
Zakharchuk / Shutterstock.com
ETH’s 1.7% drop in the last 24 hours doesn’t appear to be directly linked to the hacker’s deposits. Bitcoin (CRYPTO:BTC) also fell 1.1% to about $81,425, while Solana fell 0.9% to around $104, suggesting a broader crypto sell-off.
The hacker’s deposits exert little immediate pressure on ETH’s price. Because moving funds to Tornado Cash transfers ETH from a wallet to a smart contract, those coins never reach an exchange order book. The bigger pressure on prices may come later if the hacker decides to withdraw “clean” coins and sell them through exchanges or over-the-counter (OTC) desks—private brokers that facilitate large trades away from the public market.
Today, ETH experienced its highest trading volume early in the morning when it fell to about $2,370 but later rebounded to a peak of around $2,414 before declining again throughout the morning. However, the trading activity cannot be conclusively attributed to the hacker’s deposits.
ETH’s overall performance has been weak. It remains significantly below its September 21 high of about $2,807 and has lost 9.5% in a month where Bitcoin saw a slight gain of 0.4%. A hacker, holding $195 million in ETH, creates an apparent shadow over the market. Still, the price data does not prove it moved the market.
Four Ways Stolen Crypto Could Be Recovered
ozrimoz / Shutterstock.com
Stolen crypto usually comes back through four routes.
Stablecoin freezes. Stablecoin issuers control their contracts and can freeze tokens linked to flagged addresses, preventing hackers from cashing out.
Exchanges. If blockchain analytics companies tag a hacker’s wallet, compliant exchanges can block any deposits traced back to it before funds can be withdrawn.
Law enforcement. Agencies can seize funds that reach a custodian, like an exchange, that is subject to court orders.
Negotiated returns. Sometimes, a protocol might offer a hacker a reward (a bounty) for returning most of the stolen funds, promising not to pursue criminal charges.
However, ETH that goes through a mixer like Tornado Cash often evades these recovery methods. Because ETH lacks a central issuer that can freeze it, and Tornado Cash obscures the link between deposited and withdrawn coins, exchanges find it much harder to trace withdrawals. Given that a state-sponsored group planned this theft for six months, they are unlikely to engage in a bounty arrangement.
Regulated exchanges remain a key choke point in this process. Terry Duffy of CME Group (NASDAQ:CME | CME Price Prediction) noted on October 20 that any firm operating in the U.S. must learn how to navigate U.S. laws. Regulators often catch laundered ETH at these regulated exit points, where compliance teams can identify and flag suspicious transactions.
Can the Drift Hacker’s Stolen Crypto Be Reclaimed?
The future of recovery remains uncertain, especially if the funds continue to move through opaque channels like Tornado Cash. The coins already inside the mixer are close to gone, and the remaining 81,864 ETH looks set to follow, so recovery would depend on the hacker making a mistake at a regulated exchange. Drift users bear that cost.
For the market, if the rest of the hacker’s ETH flows into Tornado Cash and ETH holds above the $2,370 low, traders are probably treating the hack as a non-event for price. If ETH breaks below that low while the wallet keeps moving coins, the overhang could start weighing on ETH.
Contact [email protected] for any questions or corrections.
Click Here For The Original Source.
——————————————————–
