PANews reported on April 2nd that, according to on-chain analyst aryan on the X platform, in the Drift protocol vault attack, the attacker's address received funds through NEAR Intents eight days prior but remained inactive until receiving a large sum of assets from the Drift vault. The attacker transferred the funds to multiple money laundering addresses. Notably, these money laundering addresses all received funds through Backpack yesterday, and Backpack is believed to have performed KYC verification on these accounts. Subsequently, the money laundering addresses transferred the funds to an Ethereum address through Wormhole, which had previously received funds through Tornado Cash.

Previous reports indicated that Drift Protocol suffered a hacker attack, resulting in losses of at least $200 million .