Tornado Cash processed 968 deposits on July 23, marking its busiest day throughout 2026. The figure itself tells only half the story. That day, 29,573 ETH worth roughly $57.2 million moved into the mixer's Ethereum pools across 110 addresses. One address alone, labeled Drift Exploiter 4, pushed 23,095 ETH, approximately $44.4 million, through in under two hours with 245 separate deposits. This represented 78% of the entire day's inflow.

The Drift Money Emerges

These deposits mark the first significant movement from the April 1 exploit of Drift Protocol, the Solana perpetuals exchange that lost roughly $285 million in what became the largest DeFi hack of 2026. Blockchain forensics outfits including TRM Labs and Elliptic have attributed the attack with medium-to-high confidence to UNC4736, a North Korea-linked threat cluster responsible for the $1.5 billion Bybit hack. The exploiter still holds 107,165 ETH, worth around $201 million at current valuations, according to onchain tracking firm Lookonchain.

Even without this single massive inflow, the remaining 723 deposits from 109 other addresses that day exceeded most full days throughout 2025. On July 23 of that year, Tornado Cash recorded only 177 deposits total. The comparison shows how dramatically the mixer's baseline usage has shifted.

Sanctions Lift Fuels Recovery

Tornado Cash usage has climbed steadily since the U.S. Treasury's Office of Foreign Assets Control delisted it in March 2025, following a Fifth Circuit ruling that immutable smart contracts cannot be sanctioned. The mixer now captures more than 20% of crypto mixing volume in 2026, pulling in weekly inflows ranging from $10 million to $80 million according to TRM Labs data. This compares to roughly 16% market share in the years following the 2022 sanctions. The largest single day on record remains November 5, 2025, when Richard Heart-linked wallets drove 1,363 deposits.

Developer Roman Storm continues to face prosecution on money-laundering and sanctions-conspiracy charges. Prosecutors are pursuing an October retrial after a Manhattan court previously deadlocked. The legal cloud hasn't dampened the protocol's resurgence among large-scale actors, particularly those seeking to move significant sums without detection. Large-scale attackers have clearly returned since sanctions lifted, each deposit spike serving as a reminder that privacy tools remain central to the DeFi ecosystem, whether for legitimate privacy or obfuscation of illicit flows.

This article is for informational purposes only and should not be considered financial advice or a recommendation to use any particular service.