Key Takeaways:
The Drift Protocol exploiter deposited 23,095 Ether, worth $44.4 million, into Tornado Cash on July 23, resuming laundering after three months of inactivity.
On-chain analytics firm Lookonchain flagged the movement, confirming the wallet cluster tied to the April exploit had reactivated. Security firm PeckShield independently corroborated the transfers.
The address, labeled Drift Exploiter 4 on Etherscan, executed dozens of deposits in 100 ETH, 10 ETH and 1 ETH tranches into the Tornado Cash router between 08:20 UTC and 09:06 UTC, according to on-chain records. The same wallet sent 0.85 Ether to addresses flagged as Bybit deposit addresses, a pattern analysts described as test transfers before larger off-ramp attempts.
The exploiter still controls 107,165 Ether valued at about $201 million, per Arkham Intelligence data. If the current pace of 100 ETH batches continues, the remaining stash could be washed through the mixer within days, narrowing the recovery window for funds stolen in one of 2026's largest DeFi attacks.
Drift Protocol, the largest decentralized perpetual futures exchange on Solana, lost about $285 million on April 1 after attackers exploited compromised multisig signers and a fake token called CarbonVote. Mandiant attributed the breach to UNC6862, a North Korean threat group, according to Drift's investigation update. The attackers emptied key vaults within about 12 minutes.
Independent investigator ZachXBT said on X that he did not plan to track the funds further, describing the monitoring of a nine-figure North Korea-linked exploit as "difficult for a team and not feasible for a single person." Drift has said it works with law enforcement, Mandiant and blockchain intelligence firms.
The Tornado Cash deposits do not prove the attacker has converted the Ether into usable cash. The deposits remain public on-chain, and investigators may still identify later withdrawals. However, the mixer breaks the direct wallet-to-wallet trail, making the next phase of tracking more resource-intensive.
Drift previously announced a recovery bounty program with Arkham and Bybit, though the protocol has not disclosed whether the program became fully active or whether it covers ongoing wallet monitoring. Tether proposed up to $127.5 million in support as part of Drift's user recovery plan. The protocol's total value locked collapsed from about $550 million before the hack to under $250 million within a day, and the DRIFT token remains roughly 98 percent below its all-time high.
This article is for informational purposes only and does not constitute investment advice.
