Drift Protocol Exploiter Adds 1,195 ETH as Wallet Reaches 130,262 ETH

A wallet tied to the Drift Protocol exploit kept adding ether even as the protocol and outside firms were still dealing with the fallout from one of Solana DeFi’s largest recent breaches.

Lookonchain said on April 2, 2026 that the exploiter spent another $2.46 million in USDC to buy 1,195 ETH, taking the wallet to a reported 130,262 ETH worth about $267 million. The final buy-side transaction hash for that latest purchase was not surfaced in the fetchable evidence package, so the accumulation figure is reported here as externally attributed rather than independently reconstructed from a public explorer trail.

1,195 ETH

Purchased for 2.46M USDC on April 2, 2026.

The @DriftProtocol exploiter just spent another 2.46M $USDC to buy 1,195 $ETH.

They have now bought 130,262 $ETH($267M) in total.https://t.co/ZKbh8J7jRR pic.twitter.com/5Z3Jq2X9NM

— Lookonchain (@lookonchain) April 2, 2026

What the Latest ETH Purchase Shows

Transaction Specifics

The significance of the latest move is in the direction of the reported swap: $2.46 million in USDC was used to add 1,195 ETH, which points to continued accumulation rather than passive custody of already-held assets.

What is still missing is the standard on-chain proof readers would expect for that level of precision. The accessible evidence package did not expose a direct explorer page for the latest ETH-buy transaction, which means the exact execution path, timestamped trade details, and settlement venue behind the new purchase remain unavailable from a fetchable block explorer entry.

Why Traders Care

The reported balance matters because a wallet that keeps turning exploit-linked proceeds into ether tends to move from incident coverage into market monitoring. That is the same watchlist logic behind coverage of other large-wallet flows, including Trader HXiRSK Sells Another 47,401 SOL After $16.04M Buy, where position size rather than confirmed intent became the immediate trading signal.

The wallet total cited by Lookonchain is large enough to keep future outbound transfers, bridge movements, or exchange deposits in focus even without a confirmed sale. That is why the latest accumulation update matters to Ethereum traders now: it adds to a reported concentration of ETH that the market will keep tracking block by block.

Wallet Holdings Now Stand at 130,262 ETH

Wallet Snapshot

Drift said on April 1, 2026 that it was experiencing an active attack and had suspended deposits and withdrawals while coordinating with security firms, bridges, and exchanges. That official statement is the clearest protocol-level confirmation that the wallet activity sits inside a live exploit response rather than a normal treasury movement.

Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended. We are coordinating with multiple security firms, bridges, and exchanges to contain the incident. This is not an April Fools joke. We’ll provide additional updates from this account as… https://t.co/03SRPq4fHj

— Drift (@DriftProtocol) April 1, 2026

Decrypt reported that suspicious transfers from Drift vaults were sent to the Solana address beginning with HkGz4K, and the outlet said Arkham data showed more than $250 million had moved to the attacker address.

In the first large transfer at about 11:06 a.m., roughly 41 million JLP tokens worth about $155 million were moved from the Drift Vault to that same address, according to Decrypt.

Decrypt also said estimates from PeckShield put the breach at up to $285 million and pointed to a suspected leaked or exposed private key as the likely cause.

OKLink’s page for the reported Ethereum address marks it with risk category “Hack” and risk value “Other Unknown,” which supports treating the buying wallet as exploit-linked even though the latest ETH purchase itself was not independently tied to a public transaction page in the evidence package.

The reported 130,262 ETH total therefore works best as a monitored snapshot rather than a fully reproduced wallet ledger. The Arkham entity page referenced in the research brief was not directly readable from the available environment, so that aggregate balance should be understood as Lookonchain’s published tally.

Risk Watchpoints

The practical risk is not a confirmed liquidation plan but the scale of the reported ETH concentration itself. When a single exploit-linked address is described as holding that much ether, traders start watching for exchange inflows, collateral movements, or sudden distribution that could shift short-term sentiment.

Ecosystem counterparties were already moving into defensive messaging. DeFi Development Corp said it had no exposure to Drift Protocol after the exploit, and the broader stablecoin fallout has already fed into related coverage such as Circle Faces USDC Freeze Criticism After Drift Exploit.

Why Ethereum Traders Will Watch the Address Next

The immediate Ethereum angle is narrow but clear. A wallet that is still being publicly linked to fresh ETH accumulation after a major exploit is likely to stay on watchlists until either distribution begins or independently accessible transaction records make the flow easier to verify.

That means the next meaningful signal is not a headline alone but whether future transfers appear on public explorers with timestamps, counterparties, and destination addresses that can be checked without relying on a single monitoring post. Until then, the additional ETH buy and the wallet total remain important reported signals, but they are still cleaner as a surveillance story than as a definitive map of the exploiter’s full conversion trail.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are volatile, and readers should do their own research before making decisions.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.