Analysis: The money laundering route for Drift stolen funds involves Backpack accounts, with KYC information potentially serving as a key clue.

DeepFlowTech · 2026-04-02T01:55:44+00:00

Drift Protocol vault was recently drained by attackers. After obtaining initial funds through Near Intents, the attacker transferred large amounts of money to multiple money laundering addresses and used Wormhole to bridge assets to Ethereum, with the source of funds pointing to Tornado Cash. Backpack co-founder stated that the flow of funds was an indirect route.

DeepFlowTech

2026-04-02 01:55:44

Abstract generation in progress

Deep Tide TechFlow news. On April 02, according to on-chain analyst aryan (@_0xaryan) monitoring, the Drift Protocol treasury has recently been drained. The attacker address [HkG…ZES] obtained initial funds via Near Intents 8 days ago; afterward, it remained inactive for a long period, and then suddenly transferred a large amount of funds out of the Drift treasury.

In terms of the flow of funds, the attacker transferred assets to multiple money-laundering addresses (including 8ub…Gxw, etc.). All of these addresses received funds from a Backpack wallet one day before the incident. Subsequently, the launderers used the cross-chain protocol Wormhole to transfer the funds to an Ethereum address, and the source of funds for that Ethereum address points to Tornado Cash.

In response, Armani Ferrante, co-founder of Backpack, confirmed that the flow of funds is not a direct path of “Backpack → attacker,” but rather an indirect path of “Backpack → non-attacker (cross-chain intent solver) → attacker,” and stated that they have completed verification with the holders of the relevant accounts.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes