{ "version": 1, "event_id": "evt_269a773047599628", "url": "https://xiyu.news/events/evt_269a773047599628/", "json": "https://xiyu.news/api/events/evt_269a773047599628.json", "type": "security_incident", "status": "developing", "category": "crypto", "title": { "zh": "【Drift Protocol 攻击者向 Tornado Cash 转入 1.34 万枚以太坊】", "en": "【Drift Protocol 攻击者向 Tornado Cash 转入 1.34 万枚以太坊】" }, "current_state": { "zh": "Drift Protocol 攻击者持续通过 Tornado Cash 洗钱，10 月 20 日至 21 日累计存入 50,595 枚 ETH（约 1.22 亿美元），相关地址仍持有约 56,569 枚 ETH（约 1.39 亿美元）。", "en": "The Drift Protocol attacker continues laundering through Tornado Cash, with cumulative deposits on Oct 20–21 reaching 50,595 ETH (~$122M), while the related address still holds about 56,569 ETH (~$139M)." }, "first_seen_at": "2026-10-20T09:34:14.171646+00:00", "last_updated_at": "2026-10-21T10:01:25.732940+00:00", "last_material_change_at": "2026-10-21T09:29:58.345033+00:00", "confidence": 0.75, "updates_count": 4, "sources_count": 9, "entities": [ "cash", "drift", "drift-protocol", "salus", "tornado", "tornado-cash", "tornadoca" ], "identifiers": [], "topics": [ "drift-protocol", "money-laundering", "on-chain-data", "tornado-cash" ], "updates": [ { "update_id": "upd_ee89b59ed5f7e7da", "event_id": "evt_269a773047599628", "occurred_at": "2026-10-20T08:45:42Z", "published_at": "2026-10-20T08:45:42Z", "first_seen_at": "2026-10-20T09:34:14.171646Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "【Drift Protocol 攻击者向 Tornado Cash 转入 1.34 万枚以太坊】", "title_en": "【Drift Protocol 攻击者向 Tornado Cash 转入 1.34 万枚以太坊】", "what_changed_zh": "Drift Protocol 攻击者沉寂两个月后，将至少 13,400 枚 ETH（约 3200 万美元）转入 Tornado Cash，其被追踪的钱包中仍持有约 2.25 亿美元资产，包括 93,965 枚 ETH 和 477,375 枚 USDY。", "what_changed_en": "The Drift Protocol attacker, dormant for two months, moved at least 13,400 ETH (~$32M) into Tornado Cash and still holds about $225M in tracked wallets, including 93,965 ETH and 477,375 USDY.", "current_state_zh": "Drift Protocol 攻击者沉寂两个月后，将至少 13,400 枚 ETH（约 3200 万美元）转入 Tornado Cash，其被追踪的钱包中仍持有约 2.25 亿美元资产，包括 93,965 枚 ETH 和 477,375 枚 USDY。", "current_state_en": "The Drift Protocol attacker, dormant for two months, moved at least 13,400 ETH (~$32M) into Tornado Cash and still holds about $225M in tracked wallets, including 93,965 ETH and 477,375 USDY.", "detailed_summary_zh": "The Drift Protocol attacker, dormant for two months, moved at least 13,400 ETH (~$32M) into Tornado Cash and still holds about $225M in tracked wallets, including 93,965 ETH and 477,375 USDY.", "detailed_summary_en": "The Drift Protocol attacker, dormant for two months, moved at least 13,400 ETH (~$32M) into Tornado Cash and still holds about $225M in tracked wallets, including 93,965 ETH and 477,375 USDY.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120827" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115554", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_73a9072b40d74d8d", "event_id": "evt_269a773047599628", "occurred_at": "2026-10-20T09:25:27Z", "published_at": "2026-10-20T09:25:27Z", "first_seen_at": "2026-10-20T09:34:10.374928Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "盗取逾2.7亿美元的Drift Protocol漏洞利用者正将ETH转入Tornado Cash", "title_en": "The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCa", "what_changed_zh": "攻击者向 Tornado Cash 的转入规模从上一次报告的至少 1.34 万枚 ETH 增至 2.57 万枚 ETH（约 6156 万美元），剩余持仓降至约 8.19 万枚 ETH（约 1.95 亿美元）。", "what_changed_en": "The attacker's Tornado Cash deposits increased from the previously reported at least 13,400 ETH to 25,700 ETH (~$61.56M), with remaining holdings down to 81,864 ETH (~$195M).", "current_state_zh": "Drift Protocol 攻击者在两个月沉寂后持续洗钱，已向 Tornado Cash 存入 2.57 万枚 ETH（约 6156 万美元），钱包仍持有约 8.19 万枚 ETH（约 1.95 亿美元）。", "current_state_en": "The Drift Protocol attacker is actively laundering after two months of dormancy, having deposited 25,700 ETH (~$61.56M) into Tornado Cash while still holding 81,864 ETH (~$195M).", "detailed_summary_zh": "The Drift Protocol exploiter deposited 25,700 ETH worth $61.56M into Tornado Cash after two months of inactivity while still holding 81,864 ETH worth $195M.", "detailed_summary_en": "The Drift Protocol exploiter deposited 25,700 ETH worth $61.56M into Tornado Cash after two months of inactivity while still holding 81,864 ETH worth $195M.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.93, "story_ids": [ "telegram:lookonchainchannel:10698", "telegram:theblockbeats:201408", "rss:cointelegraph.com_rss:ad85fc51ec9c9b55", "rss:decrypt.co_feed:aa05a3b36eb59d7a" ], "sources": [ { "url": "https://arkm.com/explorer/entity/drift-protocol-exploiter", "label": "lookonchainchannel", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/372752?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://cointelegraph.com/news/drift-exploiter-eth-tornado-cash?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://decrypt.co/381450/wallet-drift-exploit-sends-61-million-ethereum-tornado-cash", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_17683cd1458c4fa8", "event_id": "evt_269a773047599628", "occurred_at": "2026-10-21T07:50:16Z", "published_at": "2026-10-21T07:50:16Z", "first_seen_at": "2026-10-21T09:29:58.339386Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "【Salus：Drift 黑客再向 Tornado Cash 转入 4600 枚 ETH，约合 1123 万美元】", "title_en": "【Salus：Drift 黑客再向 Tornado Cash 转入 4600 枚 ETH，约合 1123 万美元】", "what_changed_zh": "Drift Protocol 攻击者从另一长期休眠钱包向 Tornado Cash 再存入 4,600 枚 ETH（约 1123 万美元）；其追踪的两个关联钱包累计向 Tornado Cash 存入 30,310 枚 ETH，其中 0xaa8 开头地址累计存入 25,710 枚 ETH。", "what_changed_en": "The Drift Protocol attacker deposited another 4,600 ETH (~$11.23M) into Tornado Cash from another previously dormant wallet, bringing the two tracked linked addresses to a combined 30,310 ETH deposited into the mixer; the 0xaa8 address alone accounts for 25,710 ETH.", "current_state_zh": "Drift Protocol 攻击者持续通过 Tornado Cash 洗钱，两个关联钱包已累计存入 30,310 枚 ETH；其中 0xd3f 开头地址新转入 4,600 枚 ETH，监测时仍持有约 20,286 枚 ETH。", "current_state_en": "The Drift Protocol attacker continues laundering through Tornado Cash, with two linked addresses now having deposited a combined 30,310 ETH; the 0xd3f address newly deposited 4,600 ETH and still held about 20,286 ETH at the time of monitoring.", "detailed_summary_zh": "The Drift Protocol attacker deposited another 4,600 ETH (~$11.23M) into Tornado Cash from a previously dormant wallet, pushing two linked addresses to a combined 30,310 ETH in mixer inflows as laundering of the exploit proceeds continues.", "detailed_summary_en": "The Drift Protocol attacker deposited another 4,600 ETH (~$11.23M) into Tornado Cash from a previously dormant wallet, pushing two linked addresses to a combined 30,310 ETH in mixer inflows as laundering of the exploit proceeds continues.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.94, "story_ids": [ "telegram:foresightnews:120927", "telegram:theblockbeats:201608" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115642", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/372951?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_ac8808a86288ddf2", "event_id": "evt_269a773047599628", "occurred_at": "2026-10-21T09:14:26Z", "published_at": "2026-10-21T09:14:26Z", "first_seen_at": "2026-10-21T09:29:58.345033Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "【Drift 黑客过去 1 小时再向 Tornado Cash 存入 24,885 枚 ETH，约合 6104 万美元】", "title_en": "【Drift 黑客过去 1 小时再向 Tornado Cash 存入 24,885 枚 ETH，约合 6104 万美元】", "what_changed_zh": "Drift Protocol 攻击者在过去 1 小时内再向 Tornado Cash 存入 24,885 枚 ETH（约 6104 万美元），使其 10 月 20 日至 21 日累计存入量升至 50,595 枚 ETH（约 1.22 亿美元），地址仍持有约 56,569 枚 ETH（约 1.39 亿美元）。", "what_changed_en": "The Drift Protocol attacker deposited another 24,885 ETH (~$61.04M) into Tornado Cash in the past hour, raising cumulative deposits on Oct 20–21 to 50,595 ETH (~$122M), while still holding about 56,569 ETH (~$139M).", "current_state_zh": "Drift Protocol 攻击者持续通过 Tornado Cash 洗钱，10 月 20 日至 21 日累计存入 50,595 枚 ETH（约 1.22 亿美元），相关地址仍持有约 56,569 枚 ETH（约 1.39 亿美元）。", "current_state_en": "The Drift Protocol attacker continues laundering through Tornado Cash, with cumulative deposits on Oct 20–21 reaching 50,595 ETH (~$122M), while the related address still holds about 56,569 ETH (~$139M).", "detailed_summary_zh": "The attacker behind the April Drift Protocol theft deposited another 24,885 ETH (~$61M) into Tornado Cash in the past hour, taking cumulative laundering on Oct 20–21 to 50,595 ETH (~$122M) while still holding roughly 56,569 ETH (~$139M).", "detailed_summary_en": "The attacker behind the April Drift Protocol theft deposited another 24,885 ETH (~$61M) into Tornado Cash in the past hour, taking cumulative laundering on Oct 20–21 to 50,595 ETH (~$122M) while still holding roughly 56,569 ETH (~$139M).", "background_zh": "Drift 是一家基于 Solana 的去中心化永续合约交易所，其 4 月 1 日遭到的攻击造成损失，安全顾问 Mandiant 将此次攻击归因于一个朝鲜威胁组织。10 月 1 日，该协议开放了 DFX 恢复代币的申领与赎回，使受损用户对一个初始规模约 310 万美元、并获得交易所收入和追回资金的资金池拥有求偿权。Tornado Cash 是一个开源、非托管的混币器，运行于兼容以太坊虚拟机的网络，用于模糊资金来源与目的地地址之间的关联。", "background_en": "Drift, a Solana-based decentralized perpetual futures exchange, reported losses from the April 1 exploit, which its security consultant Mandiant attributed to a North Korean threat group. On Oct. 1 the protocol opened claims and redemptions for DFX recovery tokens, giving affected users a claim on a pool that launched with about $3.1 million and receives exchange revenue and recovered funds. Tornado Cash is an open-source, non-custodial mixer on Ethereum Virtual Machine-compatible networks that obscures the link between source and destination addresses.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "传导路径主要在合规与流动性层面，而非价格层面：大额 ETH 进入混币器会促使交易所、跨链桥和链上分析机构加强对可能与此次黑客事件相关存款的筛查；而仍未动用的 56,569 枚 ETH 则压低了市场对 Drift 的 DFX 求偿池回收规模的预期。", "market_impact_en": "The transmission runs through compliance and liquidity rather than price: large ETH tranches entering a mixer push exchanges, bridges and analytics firms to tighten screening of deposits that may be tied to the hack, while the still-unmoved 56,569 ETH overhang keeps recovery expectations for Drift's DFX claim pool depressed.", "importance_score": 7.5, "references": [ { "url": "https://en.wikipedia.org/wiki/Tornado_Cash", "title": "Tornado Cash - Wikipedia" }, { "url": "https://yellow.com/news/drift-recovery-plan-737-year-wait-users-revenue-hack-analysis", "title": "Drift’s Recovery Math Looks Bleak As Current Revenue Pace... | Yellow" }, { "url": "https://www.bleepingcomputer.com/news/security/us-removes-sanctions-against-tornado-cash-crypto-mixer/", "title": "US removes sanctions against Tornado Cash crypto mixer" } ], "confidence": 0.97, "story_ids": [ "telegram:foresightnews:120942", "telegram:lookonchainchannel:10718" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115654", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://x.com/lookonchain/status/2112475259907846217", "label": "lookonchainchannel", "source_type": "telegram", "official": false } ] } ] }