Analysis: The money laundering route for Drift stolen funds involves Backpack accounts, with KYC information potentially serving as a key clue.

ZkProver · 2026-04-02T02:07:02+00:00

On-chain analyst Aryan revealed details of the Drift protocol vault attack. The attacker obtained funds via NEAR Intents 8 days ago and remained inactive until they attacked the vault and transferred assets to multiple money laundering addresses. These addresses have undergone KYC verification and transferred funds to Ethereum addresses through Wormhole, which have previously used Tornado Cash.

ZkProver

2026-04-02 02:07:02

Abstract generation in progress

ChainCatcher reports that, according to on-chain analyst aryan on the X platform, during the attack on the Drift protocol vault, the attacker’s address obtained funds via NEAR Intents 8 days ago but remained inactive until receiving a large amount of assets from the Drift vault.

The attacker transferred the funds to multiple money-laundering addresses. Notably, these laundering addresses all received funds yesterday through Backpack, which should have conducted KYC verification on these accounts. Subsequently, the laundering addresses transferred the funds via Wormhole to an Ethereum address that had previously received funds through Tornado Cash.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.