Drift Protocol Attacker Moves $44M in Stolen ETH Through Tornado Cash
The attacker behind Drift Protocol's $44 million exploit transferred 23,095 ETH to Tornado Cash on Tuesday, nearly three months after the June incident. The move obscures the stolen funds' on-chain trail as security researcher ZachXBT shifts away from public tracking efforts.
Key Takeaways
- 1## Theft and Delayed Movement The Drift Protocol attacker moved 23,095 ETH—worth $44.
- 24 million at current prices—into Tornado Cash, a mixing service that disrupts on-chain transaction traceability.
- 3The transfer occurred roughly three months after the June exploit, during which the attacker siphoned funds from Drift's affected user accounts through a smart contract vulnerability.
- 4The delayed movement suggests the attacker waited for media attention and exchange monitoring pressure to subside before attempting to obscure the stolen ETH's provenance.
- 5## Tracking and Transparency Security researcher ZachXBT, who has documented several major crypto exploits and theft cases on X (formerly Twitter), signaled Tuesday that he would reduce solo public tracking work on the platform.
Theft and Delayed Movement
The Drift Protocol attacker moved 23,095 ETH—worth $44.4 million at current prices—into Tornado Cash, a mixing service that disrupts on-chain transaction traceability. The transfer occurred roughly three months after the June exploit, during which the attacker siphoned funds from Drift's affected user accounts through a smart contract vulnerability.
The delayed movement suggests the attacker waited for media attention and exchange monitoring pressure to subside before attempting to obscure the stolen ETH's provenance.
Tracking and Transparency
Security researcher ZachXBT, who has documented several major crypto exploits and theft cases on X (formerly Twitter), signaled Tuesday that he would reduce solo public tracking work on the platform. ZachXBT did not specify whether the decision was tied to Drift or reflected a broader shift in his approach to blockchain forensics.
Tornado Cash has been under increased scrutiny since the U.S. Treasury sanctioned it in August 2022, citing its use by ransomware actors and state-sponsored groups. However, the protocol remains operational and continues to serve as a liquidity pool for mixing transactions.
Why It Matters
For Traders
Resumption of large exploit fund movement may signal renewed liquidation risk if attacker begins converting ETH to stablecoins on DEX or CEX.
For Investors
Drift's protocol security concerns remain unresolved; users should evaluate whether the vulnerability has been patched and what insurance or recovery mechanism exists.
For Builders
Tornado Cash continued utility for obscuring illicit funds highlights the ongoing arms race between privacy tools and protocol forensics capabilities.
