Key Highlights
- Drift has frozen $9.2M of the roughly $295.4M stolen in the April exploit.
- About 107,165 ETH remains in three wallets, while investigators continue tracking the stolen funds.
- Drift launched a 10% recovery bounty with Bybit to help recover more of the stolen assets.
Drift Foundation has frozen about $9.2 million of the roughly $295.4 million stolen from Drift users in April, as the team continues tracking the missing funds.
In an X post on Wednesday, the Foundation said the recovery effort involves Mandiant, zeroShadow, SEAL 911, and law enforcement, with the stolen assets spread across several wallets, blockchains, and jurisdictions.
The Foundation said every recovered dollar will go into the DFX recovery pool, whether the funds are returned through a freeze, a bounty, or law enforcement action. However, most of the stolen funds remain unrecovered, leaving the recovery effort ongoing.
How the hack happened
The April attack remains one of the biggest incidents in Drift’s history. More than $270 million in assets were moved from its vaults during the exploit, with the attacker quickly converting and moving different tokens. Blockchain data at the time showed that about 51.6 million USDC, 125,000 WSOL, and 164,349 cbBTC were among the assets moved.
The attacker also bought about 41.72 million Jupiter Liquidity Pool, or JLP, tokens worth roughly $155.6 million before converting large amounts of the assets. Some of the funds were then moved to Ethereum, where the trail became more difficult to follow.
The Foundation has since brought in security and blockchain investigation firms to follow that trail.
Mandiant identified the attacker as UNC6862, which the Foundation described as a North Korean threat group. Since April, zeroShadow has also monitored the stolen funds and shared its findings with law enforcement.
A large part of the stolen money eventually reached Ethereum. The Foundation said about 130,259 ETH was spread across four wallets. Three of those wallets have not moved and still hold about 107,165 ETH.
One wallet breaks months of silence
That changed on July 23 when one of the wallets sent about 23,094 ETH to Tornado Cash, a crypto mixer designed to make transactions trails more difficult to follow. Separate blockchain tracking later put the transfer at about 23,095 ETH, worth around $44.4 million at the time.
The movement showed that the stolen funds were still being moved months after the attack. The Foundation said some of the assets have also moved through different blockchains and countries, adding further complexity to the recovery process.
Investigators continue following the money
The Foundation and zeroShadow are monitoring the relevant wallets and working with law enforcement to flag withdrawals when stolen funds move.
So far, about $9.2 million has been frozen. However, frozen funds cannot necessarily be returned to users immediately. The Foundation said law enforcement is involved in the process, which can take time.
A 10% bounty offers another recovery route
Drift is also pursuing another route to recover more funds. In partnership with Bybit, it launched a public bounty offering 10% of any successfully recovered funds. The program is aimed at security researchers, white hats, and others who may be able to help trace or recover the assets.
The Foundation is also reviewing the future of the DRIFT token as part of its wider recovery plan.
It warned users to be careful of fake recovery offers. The Foundation said it will never privately ask users to connect a wallet, pay a fee, or provide information to receive recovered funds.
The recovery effort remains ongoing, with the $9.2 million frozen so far representing only part of the funds taken in the April attack. The Foundation said it will provide another update when there is further progress.
Also Read: BTC Holds Range as Long-Term Holders Account for More Realized Profit
