According to Arkham Intelligence data, 71 tracked wallets belonging to the exploiter behind the April 1, 2026 Drift Protocol exploit retain approximately 81,454 Ether, valued between $194 million and $198.58 million

Overview Debates Related claims Topics Sources

Drift Protocol launched claims for its DFX recovery token on October 1, 2026, issuing one DFX token per USDT of verified user loss across roughly 299.5 million tokens

Attackers drained Drift Protocol in under 12 minutes by exploiting a code execution vulnerability in developer tooling, using a fake wallet application, and seizing Security Council administrative powers

The October 20, 2026 deposits to Tornado Cash from the Drift Protocol exploiter's wallet were made in fixed tranches of 100 Ether and 10 Ether to match mixer pools and obscure the sender's identity

On October 20, 2026, an Ethereum wallet labeled Drift Exploiter 5 deposited 25,700 to 25,710 Ether, valued at $61.5 million to $63.1 million, into Tornado Cash over approximately two hours

Early redemptions from the Drift Protocol DFX recovery pool on October 1, 2026 paid approximately 0.0104 USDT per DFX token, yielding victims roughly one cent on the dollar

On July 23 and 24, 2026, an address labeled Drift Exploiter 4, linked to the Drift Protocol exploit, deposited 23,095 Ether, valued at approximately $44.4 million, into Tornado Cash

The Drift Protocol DFX recovery pool is backed by daily allocations of 60% to 90% of net protocol revenue from Velocity, alongside frozen law enforcement assets and a Tether funding commitment

Beyond Ether, accounts belonging to the exploiter behind the April 1, 2026 Drift Protocol exploit hold roughly $561,600 in stablecoins and alternative crypto tokens including USDT, USDC, Solana, and USDY

The April 1, 2026 attack on Drift Protocol followed a six-month social engineering operation where attackers posed as a quantitative trading firm, deposited $1 million, and met contributors at conferences

Chainalysis reported that on April 1, 2026, the Drift Protocol exploiter moved funds from five initial exploit wallets to a single stopover wallet across 13 transactions before depositing into Tornado Cash

According to DeFiLlama's tracker, the April 1, 2026 Drift Protocol breach was the third-largest crypto exploit of 2026, behind the $387.5 million Bitget exploit and $320 million Liquid Network exploit

The April 1, 2026 exploit of Drift Protocol resulted in $295.7 million in stolen crypto assets, including $159.3 million in Jupiter Liquidity Provider tokens and $71.4 million in USDC

Coinbase's Global Intelligence team connected public blockchain transactions with evidence from social media profiles, messaging accounts, and fraudulent websites to identify scam operations.

Bitget stated customer account balances were unaffected by the September 24, 2026 security breach and completed phased withdrawal restorations by October 2, 2026

Attackers compromised Bitget's hot and warm wallet infrastructure on September 24, 2026 through a third-party security vulnerability, impacting approximately $388 million

A $1.28 million oracle manipulation exploit highlighted ongoing operational risks at Papertrade related to single-oracle dependencies and automated liquidation mechanics

Papertrade's decision to maintain token transfer restrictions follows an oracle manipulation incident that reportedly allowed an attacker to drain $1.28 million from the platform pool

Blockchain data cited by Arkham Intelligence showed Mt. Gox moved 10,422 Bitcoin worth about $739 million on June 2, 2026, while retaining over 34,500 Bitcoin

Approximately 87.1% of the QU tokens drained in the October 18, 2026 wallet drain remain immobilized directly on the Qubic network on-chain

Cryptocurrency exchange MEXC froze the receiving account holding 12.9% of the drained QU tokens within one hour of the October 18, 2026 Qubic wallet drain