Drift exploiter sends $109M to Tornado Cash, retains $138M in ETH

Drift Protocol is a crypto trading venue, and Tornado Cash is a privacy tool that has been repeatedly used in high-profile laundering cases. This story sits in the aftermath of an April exploit, with the later movement of funds showing that the wallet set tied to the incident is still active months later. October 20 and 21 are the dates that frame this update, not the original breach itself.

For people who use, hold, or build on Drift, the practical issue is that funds linked to the exploit remain in motion while a large balance is still visible in tracked wallets. That keeps any recovery effort or monitoring exercise incomplete, and it leaves investigators and counterparties watching for further movements rather than closure. The use of Tornado Cash also keeps the question of traceability front and center for anyone handling ETH flows.

The wider trade-off here is between financial privacy tools and the ability to follow stolen assets across chains and wallets. When a privacy system is part of a post-exploit transfer path, it underlines how easily on-chain transparency can be reduced in practice even when the original transfers are public. That tension matters beyond Drift because it affects how exchanges, investigators, and DeFi protocols think about asset recovery and monitoring.

What is still open is whether the remaining tracked ETH will also move and whether any of the value can be recovered from the wallets that still hold it. The public record here shows only the transfers through October 21 and the balances still visible afterward. A later wallet movement, an exchange freeze, or a recovery announcement would be needed to settle what happens next.