Hackers Transfer $109M in Stolen Ether to Crypto Mixer

Wallets associated with an April theft from a decentralized trading platform have transferred an estimated $109 million in Ether to a privacy mixing service over two days. The movement renews scrutiny on the remaining assets controlled by the perpetrators, who originally made off with approximately $295.7 million.

According to blockchain tracking firm Onchain Lens, the attacker deposited 44,510 ETH into Tornado Cash on October 20 and 21. The transfers included an estimated 18,800 ETH on Wednesday, valued at approximately $46 million. This followed a Tuesday batch of roughly 25,710 ETH, which monitors valued at around $61 million at the time of the transfer. Lookonchain also reported on the Tuesday movement, observing approximately 25,700 ETH deposited within a two-hour window.

Despite the large deposits, the attackers continue to hold a substantial reserve. Data from Arkham Intelligence indicated that following Wednesday’s transactions, addresses labeled as the exploiter still held approximately 56,569 ETH, valued at roughly $138 million. Prior to the transfers on Tuesday, the tracked wallets held an estimated 81,454 ETH worth $194 million. Earlier in August, connected wallets had already pushed around $44 million worth of ETH through Tornado Cash.

Operational Compromise

The April 1 incident, which targeted the Solana trading platform Drift Protocol, was one of the largest decentralized finance thefts of the year. In a June 3 update, the victimized platform stated that cybersecurity firm Mandiant attributed the exploit to a North Korean threat group known as UNC6862.

According to reports published after the attack, the perpetrators did not rely on a simple smart contract flaw. Instead, they spent months cultivating relationships with contributors to compromise operational access and transaction authorizations.

Compensation Mechanics

In response, the affected platform reorganized its recovery efforts, bringing in former Helium engineering executive Noah Prince and former Gauntlet team members to overhaul risk controls. A relaunch of the trading platform is intended to fund victim compensation through protocol revenue.

On October 1, the platform launched claims for DFX, a specialized Solana token distributed to users based on verified losses. The system allocates one DFX for every USDT lost, with the token's total supply fixed at exactly 299,500,810.998. The initial recovery pool launched with approximately 3.1 million USDT, establishing a starting redemption rate of roughly 0.0104 USDT per DFX, or about one cent on the dollar.

To fund ongoing compensation, the platform directs a tiered portion of its daily net protocol revenue into the recovery pool. The structure allocates 60% of the first 30,000 USDT in daily revenue, 70% of the next tier up to 100,000 USDT, and 90% of any revenue above that threshold.

Additionally, Tether committed up to 127.5 million USDT to support the effort, while other partners pledged up to 20 million USDT. Eligible victims have until January 1, 2028, at 00:00 UTC to claim their DFX, after which any remaining unclaimed tokens will be permanently burned.