After sitting idle for three months, the wallet linked to the $285 million Drift Protocol hack suddenly sprang back to life. It transferred over 23,000 Ether, approximately $44.4 million, into Tornado Cash, a privacy-focused mixer known for obscuring the trail of crypto transactions.
Gradual Movement Through Tornado Cash Raises Eyebrows
The transfer wasn’t a single massive transaction but a series of smaller deposits ranging from 1 to 100 ETH into Tornado Cash’s router. This pattern, documented extensively on Etherscan under the tag “Drift Exploiter 4,” involved hundreds of transactions making it harder to trace the funds directly. also a handful of transfers totaling 0.85 ETH were sent to wallets identified as Bybit deposit addresses, suggesting attempts to further layer the stolen assets.
Onchain Lens reported the hacker resumed sending 100 ETH batches multiple times per minute starting July 23, continuing into the next day. This activity came after months of near silence since the April exploit.
Challenges in Tracking Tornado Cash Transactions
Tornado Cash pools deposits and allows withdrawals through different addresses, breaking straightforward links between sender and receiver wallets. This complicates investigations, requiring more sophisticated timing and pattern analyses as well as extensive resources. Independent investigator ZachXBT acknowledged this difficulty, stating he would not continue tracking the funds without institutional support due to the immense effort needed. He highlighted the challenge by referencing the ongoing monitoring of a massive North Korean-linked theft, which demands a team rather than a single person.
Despite his statement, Drift continues to work with law enforcement agencies, blockchain intelligence companies, and security firms like Mandiant to recover the stolen assets. The protocol had earlier announced a recovery bounty program in partnership with Arkham and Bybit, dispelling rumors that no efforts were underway.
Partial Movement of the Stolen Assets
The $44 million moved is just a fraction of the total stolen, which Drift previously put at nearly $296 million spanning various tokens including JLP, USDC, Bitcoin-linked assets, SOL, and WETH. Much of the theft remains in a small set of flagged Ethereum wallets.
This recent activity adds urgency to recovery efforts and highlights the complexities involved in tracking and freezing illicit crypto flows, especially when mixers like Tornado Cash are used.
This content is for informational purposes and does not constitute financial advice.
