Drift-Linked Wallet Sends $54.8 Million in ETH to Tornado Cash

Drift Protocol, a Solana-based lending and perpetuals platform, suffered a hack on April 1 with losses of about $295 million. A Mandiant investigation later attributed the theft to a North Korean threat group, placing it alongside other state-linked exploits that funnel stolen crypto through Ethereum mixers. The attacker's wallets then sat untouched for roughly two months before this latest transfer began.

Five Etherscan-labeled exploiter wallets still hold about 84,164 ETH, so every batch sent to Tornado Cash shrinks what investigators and Drift's recovery effort can realistically claw back. Exchanges and compliance desks must now screen for addresses downstream of this mixer activity, while Drift users awaiting reimbursement face a longer wait. Blockchain analysts gain new addresses to trace, but the protocol's recovery fund remains effectively frozen.

Tornado Cash was built to anonymize transfers for any user, yet it keeps surfacing as the preferred exit for hackers tied to state actors moving hundreds of millions in stolen ETH. That duality sustains the argument for treating mixers as inherently high-risk infrastructure, even as critics counter that sanctioning code rather than conduct punishes legitimate privacy use alongside criminal laundering. Neither side has settled the question since the original 2022 sanctions.

The remaining balance across the five labeled wallets, last estimated near 84,164 ETH, is the figure to track for signs the exploiter is liquidating in tranches rather than all at once. Any follow-up Mandiant findings or fresh OFAC action against newly identified addresses would mark the next concrete step. Until then, each Tornado Cash deposit functions as a running tally of what Drift's recovery process has effectively lost.