On October 20, the hacker transferred 25,700 ETH, worth approximately $61.5 million, to Tornado Cash. The transfers lasted for two hours. According to Lookonchain, an additional 81,864 ETH, valued at $195 million, remain on addresses controlled by the attacker.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity. Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M). https://t.co/FRtFrS7rewhttps://t.co/9ISUIlkHvT
— Lookonchain (@lookonchain) October 20, 2026
Analysts at Onchain Lens observed the movement of 13,400 ETH worth $32 million. At that time, the attacker still held assets valued at $224.5 million. Discrepancies among analysts on different platforms can be attributed to their tracking of different addresses, making it difficult to determine the total amount of funds remaining with the attacker. The fact that ETH was moved to Tornado Cash does not confirm that the assets will be cashed out, sold on an exchange, or transferred to a third party.
Drift exploiter moves $32M in $ETH after 2 months. The Drift Protocol exploiter is active again, sending at least 13.4K $ETH (~$32M) to Tornado Cash, potentially to obscure the fund trail. Still holds $224.59M across tracked wallets: · 93.965K $ETH ($224.04M) · 477.375K $USDY ($548.98K) · 1.33 $SOL ($138)
— Onchain Lens (@OnchainLens) October 20, 2026
On April 1, a hacker attacked the Drift protocol. Chainalysis estimated the loss at $285 million—more than half of the protocol’s total value locked (TVL).
An attacker exploited a vulnerability related to Solana’s durable nonce feature, which allows pre-signed transactions to remain valid until execution. After obtaining the required number of signatures, the attacker gained administrative control and added a counterfeit token, CarbonVote Token (CVT), as collateral. According to Chainalysis, the attacker simulated trading activity around CVT to fabricate a false price history. The attacker then used this token as collateral to withdraw real crypto assets.
The hacker who stole funds from Drift Protocol started withdrawing them through Tornado Cash as early as July, in fixed transactions of 100 ETH. According to Onchain Lens, the total loss from hacks of crypto projects in the first six months of this year amounted to $1.32 billion.