The exploiter is still moving money, and the trail is getting harder to follow
The attacker behind Drift’s $295 million April exploit isn’t done laundering what it stole. A wallet tied to the hack sent another 18,800 ETH, worth about $46 million, into Tornado Cash on Wednesday, according to Cointelegraph. That’s on top of roughly 25,710 ETH the same cluster of wallets moved into the mixer a day earlier, per blockchain tracker Onchain Lens.
The two-day run now totals 44,510 ETH, about $109 million, or nearly 37% of the funds taken from the Solana-based decentralized exchange in April. Each deposit into Tornado Cash makes it harder for investigators, and for Drift’s own recovery effort, to trace where the money ends up.
Key Takeaways
- A Drift exploiter-linked wallet sent 18,800 ETH (about $46 million) to Tornado Cash on Wednesday, Oct. 21.
- Combined with Tuesday’s 25,710 ETH transfer, the two-day total reached 44,510 ETH, roughly $109 million, according to Onchain Lens.
- The exploiter-labeled wallets still hold 56,569 ETH, about $138 million, per Arkham data.
- The April 1 Drift hack cost $295 million and ranks as 2026’s third-largest crypto hack, according to DefiLlama.
- Drift opened claims for its DFX recovery token on Oct. 1, but the recovery pool depends partly on funds that may never be recovered.
What moved, and when
Onchain Lens flagged the activity as it happened: 25,710 ETH, then worth about $61 million, left exploiter-linked addresses for Tornado Cash on Tuesday, and another 18,800 ETH followed Wednesday, Cointelegraph reported. FinanceFeeds adds that the renewed activity followed roughly two months of inactivity on those wallets, and that it isn’t the exploiter’s first trip to the mixer: in July, a Drift-linked address sent 23,095 ETH, then worth about $44.4 million, through Tornado Cash. Combined with this week’s deposits, that puts the total routed through the mixer since the hack at roughly 67,605 ETH, though the dollar values aren’t directly comparable across the two dates given how much ETH’s price has moved in between.
Despite the fresh outflows, the exploiter’s wallets aren’t empty. Arkham’s labeling shows 56,569 ETH, worth about $138 million, still sitting in exploiter-tagged addresses after Wednesday’s transfers, per Cointelegraph.
Why Tornado Cash makes this harder to track
Tornado Cash works by pooling deposits from many users and letting them withdraw to a different address with no direct on-chain link between the deposit and the withdrawal. That breaks the simple wallet-to-wallet trail that blockchain trackers like Onchain Lens and Arkham rely on to label funds as “stolen” in the first place. Once ETH exits the mixer to a fresh address, it no longer carries the exploiter tag, even though the underlying asset hasn’t changed.
That distinction matters for how this story should be read. As FinanceFeeds notes, moving funds into Tornado Cash doesn’t mean they’ve been sold, converted to cash, or placed beyond reach. It means the $109 million has changed addresses in a way that’s designed to resist tracing, not that it has left the crypto ecosystem entirely.
The stakes for Drift’s recovery effort
Drift attributed the April 1 hack to a North Korean threat group, identified by security consultant Mandiant, and the exploit remains the third-largest crypto hack of the year by DefiLlama’s count, Cointelegraph reported. The exchange opened claims and redemptions for DFX, its recovery token, on Oct. 1. DFX gives affected users a claim on a pool that launched with about $3.1 million and is designed to grow from ongoing exchange revenue and any funds that get recovered from the attacker, Cointelegraph said.
That recovered-funds piece is exactly what’s at risk as more ETH flows through Tornado Cash. Drift Foundation has previously disclosed that about $9.2 million in stolen assets had been frozen, but FinanceFeeds notes that releasing those funds still requires legal and law-enforcement procedures, so the frozen amount can’t yet be counted as compensation in hand. With $138 million in exploiter-tagged ETH still outside the mixer, there’s a meaningful pool of funds that remains theoretically traceable, for now.
What to Watch
The 56,569 ETH still sitting in exploiter-labeled wallets is the figure worth tracking. Whether it moves to Tornado Cash in the same pattern as the past two days, or gets frozen through the kind of legal process that recovered the $9.2 million Drift has already flagged, will shape how much of the $295 million ultimately becomes recoverable for DFX holders.
