Wallets attributed to the April 1 Drift Protocol exploiter deposited 25,700 ether into Tornado Cash over roughly two hours on October 20, a move valued at approximately $61.56 million at the time of the transfers.
Blockchain investigator Lookonchain reported the deposits following around two months without significant activity from the addresses it tracks. The development concerns the movement of assets associated with an existing theft, not a second intrusion into the Solana-based trading platform. The destination is a privacy-focused Ethereum protocol, making subsequent tracking more difficult without proving that the money has been converted to cash or reached any final beneficiary.
The scale matters for Drift creditors: around $61.6 million in traceable crypto entered a privacy system as the protocol continues to manage the aftermath of its roughly $295 million April exploit. But deposits to a mixer are not recoveries, new losses charged to Drift or proof that an identified individual controls every labeled wallet.
What Did Lookonchain Find in the Drift Exploiter Wallets?
In its October 20 on-chain alert, Lookonchain attributed 25,700 ETH in Tornado Cash deposits to the Drift exploiter over approximately two hours. Using its contemporaneous valuation of $61.56 million, the implied price was close to $2,395 per ETH. The dollar amount will change if ETH’s market price moves, but the reported token count describes the movement itself.
The investigator said the associated wallets still held approximately 81,864 ETH, then valued near $195 million, after the deposits. That is a snapshot of a researcher-defined wallet set, not an audited consolidated balance of all assets stolen in the April incident. Estimates from tracking services can differ according to the addresses included and observation time.
The event follows an extended period of apparent inactivity. Older exploiter-linked assets therefore became newly active on Ethereum, even though Drift operates primarily in the Solana ecosystem. Following stolen funds across chains requires tracking intermediate conversions and bridges rather than treating the original exploit address as the only relevant location.
The visible transaction trail shows funds reaching Tornado Cash deposit contracts. A public alert about that movement does not identify the individual who initiated the transactions, reveal subsequent private withdrawals or establish that all deposits correspond to separate human users.
How Does the $61.56 Million Transfer Relate to the April Hack?
Drift disclosed a major exploit on April 1, 2026. Loss estimates have varied by reporting date and valuation methodology, with approximately $295 million widely cited for the incident and some chain analytics using lower figures. The latest mixer activity is a later stage in the movement of assets associated with that breach.
Following a forensic investigation, Drift said evidence pointed to a North Korea-linked threat group, while researchers continued tracing assets through several networks. That attribution pertains to the earlier exploit and investigative findings; the October 20 transfer alone does not establish new state involvement or a fresh compromise.
Drift subsequently created a creditor-recovery structure using DFX claims, with token holders seeking repayment from a recovery pool funded by available assets, ongoing platform revenue and potentially recovered funds. DaveFinances previously examined the recovery terms available to Drift claimants and the gap between recognized claims and immediately distributable value.
The $61.56 million figure should not be counted as new customer losses or deducted mechanically from Drift’s recovery pool. It describes movement of assets attributed to the exploiter, and the relationship between any particular stolen asset and a specific creditor’s claim would require separate evidence.
Why Is Tornado Cash a Significant Destination?
Tornado Cash uses smart contracts and privacy mechanisms that can make it difficult to connect a visible incoming deposit with a later withdrawal. For investigators, deposits into the service can complicate tracing even when the source transaction and amount are publicly observable.
The functionality does not establish that every person using a privacy system is engaged in a crime. In this case, the concern arises from Lookonchain’s attribution of the source wallets to a previously documented exploit and from the volume of deposits, not merely the use of Tornado Cash.
Blockchain intelligence firms can trace where deposits enter a mixer and sometimes identify downstream clusters through additional evidence. But they cannot simply infer the final recipient from a deposit alone. Similarly, knowing the ETH was deposited does not prove that it was exchanged for fiat currency or sold through an exchange.
The tactic resembles other flows discussed in DaveFinances’ report on Bitget attacker-linked funds routed across chains toward privacy infrastructure. Those cases are independent: comparable transaction patterns should not be treated as proof of a shared operator.
For recovery teams, the practical stakes depend on where funds were held before entering a privacy service, which intermediaries may possess identifying records, and whether any wallet or exchange can lawfully restrict suspect assets. Deposit counts by themselves cannot answer those questions.
Does This Mean More Drift Funds Are Unrecoverable?
Not necessarily, although the change in location may make tracing and recovery harder. The public alert does not establish whether investigators had already identified all of the deposited funds, whether any relevant legal actions are pending or whether other recoverable assets remain elsewhere.
The fact that Lookonchain reported a substantial remaining balance is especially important. At the time of its observation, its labeled wallet set held significantly more ETH than the amount just sent to Tornado Cash. Future transfers from that cluster could be consequential, but there is no basis to predict the next destination or timing.
For Drift users, the relevant distinction is between monitoring the exploiter’s assets and the formal mechanisms governing compensation. Claims, redemptions, distributions and any recovery milestones should be checked against Drift’s official processes, not inferred from movements through third-party wallets.
There is also a broader industry lesson in the limits of freezing stolen funds in decentralized finance: a transfer may remain visible on public blockchains long after the opportunity to prevent further movement has narrowed.
What Should Investigators and Traders Watch Next?
The most useful new evidence would include transaction identifiers for the deposits, an updated wallet inventory, independent confirmation of the attribution, and any statements from Drift or investigators about asset-recovery efforts. Those records could establish whether the 25,700 ETH total was complete or whether additional deposits followed the initial two-hour observation.
For market participants, a $61.56 million flow is not equivalent to a $61.56 million sell order hitting an exchange. A mixer deposit may change the traceability of assets without immediately creating spot-market selling pressure. Claims that the entire amount was dumped into ETH markets would require separate exchange-flow or trading evidence.
The October 20 development is thus a major movement of funds linked by Lookonchain to one of 2026’s largest crypto exploits. Its significance lies in the progression from identifiable exploiter-related wallets into a privacy protocol, not in any confirmed second attack, established final destination or newly verified loss for Drift customers.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574