Drift Protocol Attacker Moves 4,600 ETH to Tornado Cash Mixing Service

On October 21, 2026, security monitoring services detected renewed activity from wallets linked to the Drift Protocol exploit. Between 15:00 and 15:19 Beijing time, an attacker transferred 4,600 ETH, valued at approximately $13.23 million, into the decentralized mixing protocol Tornado Cash. The movement represents a significant escalation in the attacker's efforts to obfuscate the trail of stolen digital assets following a period of prolonged inactivity.

Large-Scale Fund Movement via Dormant Wallets

According to data provided by the security firm Salus, the recent transactions originated from a wallet that had remained dormant for approximately 202 days. The funds were moved in a series of 46 separate transactions, each aimed at funneling the Ethereum into the privacy-preserving mixer. Despite this recent activity, the specific wallet utilized in this latest round of transfers still retains a substantial balance of 20,285.82 ETH.

Cumulative Impact and Tracking Data

Security analysts have been monitoring multiple addresses associated with the breach to map the total volume of laundered assets. The broader scope of the attacker's activities includes:

• A primary tracked wallet deposited an additional 6,110 ETH into Tornado Cash.
• The total cumulative deposits for that specific primary wallet have reached 25,710 ETH.
• Across two primary tracked addresses, the attacker has now deposited a combined total of 30,310 ETH into the mixer.

Tornado Cash remains a controversial tool in the decentralized finance (DeFi) space, frequently utilized by exploiters to break the on-chain link between the source of funds and their eventual destination.

Analysis of the Drift Protocol Breach

The Drift Protocol, a Solana-based perpetual swap exchange, has been subject to intense scrutiny since the initial exploit. The ability of the attacker to maintain control over such vast quantities of Ethereum over an extended period suggests a calculated approach to liquidation.

The two tracked wallets have cumulatively deposited 30,310 ETH into Tornado Cash, indicating a systematic attempt to process the illicit gains through privacy protocols.

The ongoing movement of funds serves as a reminder of the persistent security challenges facing DeFi platforms and the difficulties regulators face in tracking assets once they enter non-custodial mixing services. While security firms continue to monitor the remaining balances, the lack of immediate sell pressure on centralized exchanges suggests the attacker is prioritizing anonymity over immediate liquidity. Blockchain observers expect further movements as the attacker attempts to clear the remaining thousands of ETH still held in identified dormant wallets.