Drift Foundation Froze $9.2 Million in Stolen Crypto
The foundation successfully halted a portion of the funds stolen during an April security incident.
Updated on Sept. 30, 2026 in Financial Crime
Live Poll
Do you trust cryptocurrency platforms to recover assets after a security breach?
The Drift Foundation has frozen $9.2 million in assets following a massive security breach that originally compromised $295 million in user holdings. The organization is working to recover the stolen funds, which were bridged to the Ethereum network and split across multiple wallets.
Why it matters
Recovering these assets is a critical step in addressing the impact of the April incident on users. By partnering with external security firms and offering a bounty, the foundation aims to mitigate the long-term financial fallout for the platform.
The foundation successfully froze $9.2 million in stolen assets, part of a larger total of 130,259 ETH that was bridged to the Ethereum network. Authorities have not yet identified the specific individuals behind the four wallets involved.
The players
Drift Foundation
This is a decentralized finance organization currently working to recover user assets and stabilize its platform after a major hack.
Mandiant
Mandiant is a cybersecurity firm hired to assist in forensic investigations regarding the theft of user assets.
Bybit
Bybit is a cryptocurrency exchange that has partnered with the foundation to implement a bounty program for recovered funds.
SEAL 911
SEAL 911 is a specialized security initiative providing emergency response and investigative support for blockchain-based incidents.
Tornado Cash
Tornado Cash is a decentralized privacy protocol that was used to facilitate the movement of stolen funds during the heist.
The details
After the initial security breach in April, hackers moved the stolen funds across four distinct Ethereum wallets. The foundation has since engaged Mandiant, zeroShadow, and SEAL 911 to investigate the theft and help track the illicit transactions, which included activity involving Tornado Cash.
Timeline
The security incident occurred in April 2026.
A total of 23,094 ETH was moved to Tornado Cash on July 23, 2026.
Frozen funds were processed through Tornado Cash throughout August 2026.
Legal Context
This incident follows the pattern of asset recovery efforts seen in the 2022 Ronin Network bridge exploit. It highlights the growing complexity of tracking stolen funds across decentralized networks and privacy-focused protocols.
Users impacted by the April incident should monitor official foundation updates regarding the DFX recovery pool. The outcome of the ongoing investigation and the success of the bounty program will determine if and when affected parties can recover their holdings.
The takeaway
Crypto platforms continue to face significant challenges when funds move through privacy-focused protocols that obscure transaction trails. Security experts advise investors to remain vigilant and prioritize platforms that have robust, multi-firm forensic partnerships.
Further reading
Learn more about ongoing efforts to mitigate digital theft in Financial Crime.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust cryptocurrency platforms to recover assets after a security breach?
