The wallet linked to the Drift Protocol exploit has reportedly purchased an additional 1,195 ETH for $2.46 million in USDC, pushing the total balance to 130,262 ETH, according to unconfirmed reports. The latest accumulation extends a rapid conversion campaign that began hours after the Solana-based trading platform lost more than $270 million on April 1.
Drift Protocol exploiter adds 1,195 ETH in latest buy
A single source reported that the wallet identified as belonging to the Drift Protocol exploiter swapped $2.46 million USDC for 1,195 ETH. The purchase lifted the wallet’s holdings from the previously verified 129,066 ETH to a reported 130,262 ETH. No authoritative Ethereum explorer link or corroborating media report has been located for this specific incremental transaction.
The broader exploit was confirmed by Drift Protocol itself on April 1, 2026. The project stated it was experiencing an active attack and had suspended deposits and withdrawals while coordinating with security firms, bridges, and exchanges.
Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We’ll provide additional updates from this account as… https://t.co/03SRPq4fHj
— Drift (@DriftProtocol) April 1, 2026
Source: @DriftProtocol on X
How the exploit unfolded
On-chain analytics firm Lookonchain flagged over $270 million in assets suspiciously transferred to wallet HkGz4K. The first major movement was 41 million JLP tokens, worth roughly $155 million, drained from Drift Vault 1 at approximately 11:06 a.m. ET.
ON-CHAIN DATA
- Exploiter wallet: HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES
- Reported exploit total: Over $270M in assets
- First suspicious transfer: 41M JLP (~$155M) from Drift Vault 1
- Chain: Solana (bridged to Ethereum)
The attacker then swapped stolen assets into USDC and bridged them to Ethereum. Early tracking showed accumulation rising from 19,913 ETH to 38,820 ETH, worth roughly $82.6 million. The conversion continued until the total reached 129,066 ETH, representing the bulk of the stolen funds moved into a single asset.
Wallet balance rises to 130,262 ETH after the purchase
If the latest unconfirmed 1,195 ETH buy is accurate, the wallet now holds 130,262 ETH. At ETH’s price of roughly $2,051, that position would be valued at approximately $267 million. The full USD figure cited in the original report was truncated and cannot be independently confirmed.
Why the growing total matters more than a single buy
The 1,195 ETH purchase is small relative to the 129,066 ETH already accumulated. Its significance lies in the pattern: the exploiter continues converting and consolidating into ETH rather than dispersing funds across multiple tokens or privacy protocols. That ongoing concentration gives on-chain investigators a single wallet to track.
The incident has already triggered sharp fallout for Drift’s native token. DRIFT fell 40.24% over 24 hours, dropping to $0.042, while the protocol’s total value locked sat at roughly $245.96 million at the time of the latest data check. Separately, Tommy Shaughnessy publicly criticized Circle over the role of USDC in the exploit’s laundering pipeline.
Why the market watches exploiter-linked ETH accumulation
A wallet holding over 130,000 ETH ranks among the largest non-exchange, non-institutional Ethereum positions. Any movement, whether a partial liquidation, a bridge to another chain, or a deposit to a mixer, could generate immediate sell-side pressure and volatility alerts across trading desks.
For now, no regulator or law enforcement agency has publicly disclosed action related to the Drift exploit as of April 2, 2026. The response has centered on Drift’s internal coordination with security firms, bridges, and exchanges. That containment effort is ongoing, and no timeline for resuming deposits or withdrawals has been announced.
The broader DeFi ecosystem continues to absorb security lessons from large exploits. Events like the TRON DAO’s support at the Penn Blockchain Conference highlight the industry’s growing emphasis on security auditing and developer education. Meanwhile, institutional developments such as Morgan Stanley’s Bitcoin ETF progress underscore the contrast between maturing traditional finance on-ramps and persistent smart contract risks in DeFi.
Traders monitoring the exploiter wallet should watch for any outbound transfers from the consolidated ETH position. Until then, the 130,262 ETH total, if confirmed, represents one of the largest exploit-linked holdings currently sitting on Ethereum.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.