Drift Protocol exploiter resumes moving $285M in stolen funds after three-month pause
Security & Exploits ·
The wallet behind Drift Protocol's $285M exploit has begun depositing stolen ETH into Tornado Cash in rapid batches of 100 ETH, ending a three-month period of dormancy.
The deposits, flagged via x.com, mark the first on-chain activity from the exploiter's address since funds were last tracked following the original attack. The 100 ETH denomination is one of the fixed amounts Tornado Cash supports, alongside 0.1, 1, and 10 ETH, allowing a depositor to later withdraw the same sum to a new wallet with no on-chain link to the source. Because the protocol relies on zkSNARK proofs and a Merkle tree of deposit commitments, the withdrawal address cannot be directly tied to the original deposit without off-chain analytics.
Wallet activity tied to the exploiter has been tracked on arkm.com, which shows the entity behind the address associated with the stolen funds. The renewed movement follows a pattern seen elsewhere in decentralized finance, where exploiters wait out periods of heightened scrutiny before laundering proceeds through the same mixer. Tornado Cash's own background, detailed on leviathan.news, notes that blockchain analytics firm Chainalysis has at various points estimated more than 30% of the protocol's volume originating from sanctioned entities, exploits, and criminal wallets.
The Drift case adds to a broader run of exploit-linked deposits into the mixer this year, including a DLMC attacker routing 37 ETH through Tornado Cash after a $222.5K BNB Chain oracle attack, and a KyberSwap exploiter sending another 2,000 ETH into the protocol as its laundering total reached $40M. A separate incident saw a Fluid rewards exploit drain 125,000 FLUID and 51.9 GHO tokens, later laundered through the same infrastructure after a key compromise. In a physical-attack case, $5.3M of a $6.7M theft from a Kraken and Coinbase user reportedly reached Tornado Cash as well.
The legal backdrop remains active: prosecutors have pushed for a retrial of Tornado Cash co-founder Roman Storm after rejecting his copyright defense, even as a judge has separately rebuked a prosecutor at a related hearing and weighed acquittal on all counts.
What remains unclear is how much of the $285M Drift sum has moved so far, whether the deposits will continue at the same 100 ETH pace, and whether any of the funds will ultimately be traced to a withdrawal address through analytics work similar to the demixing techniques used in past investigations.