Drift Protocol Exploiter Moves $54.8M–$61.6M ETH to Tornado Cash
Security
Bearish

Drift Protocol Exploiter Moves $54.8M–$61.6M ETH to Tornado Cash

Wallets linked to the April Drift Protocol exploit moved between $54.8 million and $61.6 million in ETH to Tornado Cash, according to on-chain monitoring. Remaining stolen funds across multiple addresses total approximately 84,164 ETH, with recovery efforts ongoing.

Oct 20, 2026, 11:01 AM1 min read

Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work

The Latest Movement

Wallets associated with Drift Protocol's April exploit transferred a significant amount of ETH to the privacy mixer Tornado Cash, according to Etherscan labels and on-chain analysis. The Defiant reported the transfer at $54.8 million; Crypto.news cited 25,700 ETH valued at $61.56 million at the time of the move. The discrepancy likely reflects different timestamps for the transaction and ETH price volatility between reporting outlets.

Scope of Remaining Stolen Funds

Five Etherscan-labeled Drift exploiter wallets still hold approximately 84,164 ETH combined, according to The Defiant's tracking. This represents the bulk of the stolen assets that have not yet been moved or recovered. The exploiter's decision to route funds through Tornado Cash, which obfuscates transaction history, complicates tracing and recovery efforts by security firms and law enforcement.

Status of Recovery Efforts

Drift Protocol's recovery process has continued for months following the April theft on Solana. The use of privacy-enhancing tools like Tornado Cash suggests the exploiter may be attempting to distance themselves from the stolen funds before moving them to exchange liquidity or converting them to other assets. Recovery teams typically monitor both the originating wallets and known mixing service outputs to identify subsequent movement.

Why It Matters

For Traders

Movement to Tornado Cash suggests the exploiter may soon attempt exchange deposits; watch for regulatory alerts on major CEX deposit addresses monitoring these pools.

For Investors

Unrecovered protocol exploits and mixer usage underscore ongoing security and compliance risks for cross-chain DeFi platforms and their users.

For Builders

Drift's recovery timeline illustrates the difficulty of retrieving bridged funds; protocols should model exploit recovery speed into their risk frameworks.

This article is for information only and is not financial advice. Read the full disclaimer.

Live prices:Ethereum

Related Articles

Latest News