Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH

Drift Protocol's April exploit drained roughly $295 million from the Solana-based lending and perpetuals platform, one of the year's largest DeFi thefts. Tornado Cash, the Ethereum mixer the exploiter chose, was sanctioned by the US Treasury in 2022 and later delisted in 2025 after a federal appeals court found OFAC had overstepped its authority. That reversal restored the tool exploiters now use again to obscure stolen funds.

The 44,510 ETH sent through Tornado Cash over two days breaks on-chain links that investigators and exchanges rely on to freeze stolen assets before they reach fiat off-ramps. Drift users awaiting any reimbursement now watch a shrinking recoverable pool, with $138 million still sitting in tracked wallets. Compliance teams at exchanges gain a fresh set of tainted addresses to screen, while the exploiter gains a path to eventually cash out undetected.

Tornado Cash's return to legal use after its 2025 delisting revives a genuine dispute: privacy tools built for legitimate users are the same tools that let a $295 million theft disappear into anonymity. Chain analysts can still flag deposits and sometimes trace withdrawals, but mixing breaks the simple wallet-tagging that made April's theft easy to follow. Treating the delisting as settled policy ignores how directly it now serves large-scale laundering.

Attention now turns to the roughly $138 million still held in exploiter-linked wallets, and whether it follows the same route through Tornado Cash in the coming weeks. Further tranches moved on the same cadence as October 20 and 21 would signal a deliberate laundering schedule rather than a one-off cash-out, and would test whether blockchain trackers like Onchain Lens can flag withdrawals before they reach exchanges.