The attacker behind the Drift Protocol exploit has funneled a sizable Ether stash into the sanctioned mixing service, according to blockchain trackers.
An attacker connected to a security breach at Drift Protocol has moved $109 million in Ether into Tornado Cash over the past two days. The figure was reported by Cointelegraph and CryptoBriefing, both citing on-chain data tracking the exploiter’s wallet activity.
Drift Protocol operates as a decentralized exchange and trading platform built on Solana, offering perpetual futures and lending products. Exploits targeting DeFi protocols typically involve attackers draining liquidity pools or manipulating smart contract logic to extract funds. Once stolen assets leave the protocol, attackers often move quickly to obscure the trail before exchanges or law enforcement can freeze related addresses.
Tornado Cash is a decentralized mixing service built on Ethereum. It breaks the on-chain link between a sender and a receiver by pooling deposits from many users and allowing withdrawals to new addresses. The U.S. Treasury’s Office of Foreign Assets Control sanctioned Tornado Cash in 2022, citing its use by North Korea-linked hacking groups to launder stolen crypto. That sanction was later challenged in court and has gone through legal revisions, but the protocol remains a frequent destination for illicit funds.
The scale of the transfer in this case stands out. Moving $109 million in Ether through a mixer in just two days represents a substantial laundering effort, even by the standards of major DeFi exploits. Large transfers into Tornado Cash can also strain the mixer’s available liquidity pools, sometimes making it harder for an attacker to fully anonymize funds without drawing further attention from blockchain analytics firms.
Security researchers and chain-analysis firms typically respond to exploits like this by publishing wallet addresses associated with the attacker. Exchanges then use these alerts to flag or freeze incoming deposits tied to the stolen funds. This kind of coordinated tracking has, in past incidents, limited an attacker’s ability to convert illicit crypto into fiat currency or other liquid assets.
Drift Protocol has not publicly detailed the full scope of the exploit beyond what has circulated through on-chain monitoring. The broader DeFi sector has faced a string of exploits in recent years, with total losses across protocols running into the billions of dollars. Each incident renews scrutiny of smart contract audits, bridge security, and the mixing services that follow in their aftermath.
Sources disagree on this story
This article was published before the reports below were compared. The reporting above stands; what follows is where the published accounts do not agree.
Cointelegraph and CryptoBriefing report $109 million moved to Tornado Cash over two days, while Cointribune EN reports $122.3 million for the same window.
What all sources agree on
- Wallets linked to the April 2026 hack of Drift Protocol sent funds to Tornado Cash over a two-day period, October 20-21, 2026.
- Drift Protocol, a Solana-based decentralized exchange, was hacked on April 1, 2026.
- Drift opened a claims process for DFX recovery tokens on October 1, 2026, backed by a pool that started with about $3.1 million.
Where the reports disagree
1Total amount sent to Tornado Cash over the two-day window
The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.
Over two days, addresses linked to the April exploit of Drift Protocol pushed roughly 44,510 ETH, worth about $109 million, into the Tornado Cash mixer.
In just two days (October 20 and 21), the hacker divided his loot into 520 successive transactions to send 122.3 million dollars worth of ethereum to Tornado Cash.
What would settle it: On-chain transaction records for the exploiter-linked wallets on Tornado Cash deposits between October 20-21, 2026.
2Total losses from the original April hack
The Solana-based DEX reported about $295 million in losses from the April 1 hack
Total losses from the exploit came to approximately $295 million.
The initial attack on Drift Protocol (Solana) involved total damages of $285 million.
What would settle it: Drift Protocol's own post-mortem disclosure or Mandiant's published incident report on the April 1 hack.
What to make of it
Treat the two-day Tornado Cash laundering window (Oct 20-21) and the underlying Drift Protocol hack as established; do not rely on a single dollar figure for either the amount laundered or the total hack losses until the underlying on-chain data or Drift's own disclosures are checked.
Market Impact
A $109 million outflow into Tornado Cash does not directly move broader crypto prices, but it can affect sentiment around the protocols and chains involved. Drift Protocol's users and liquidity providers may watch closely for any statements on fund recovery or compensation plans. Renewed large-scale use of Tornado Cash could also reignite regulatory debate over mixing services and their role in laundering stolen crypto assets.
For the broader Solana and DeFi ecosystem, the exploit adds to an ongoing pattern of security incidents that has periodically weighed on user confidence in decentralized trading platforms. Exchanges and analytics firms are likely to continue monitoring the attacker's wallet activity for further movements.
The flow of funds into Tornado Cash underscores how quickly attackers can attempt to launder large sums after a DeFi exploit. Further developments will depend on whether blockchain trackers can trace withdrawals or whether Drift Protocol issues an official response.
Frequently Asked Questions
What is Drift Protocol?
Drift Protocol is a decentralized exchange built on the Solana blockchain, offering perpetual futures trading and lending services to crypto users.
What is Tornado Cash?
Tornado Cash is a decentralized Ethereum mixing service that obscures the link between sending and receiving addresses, making stolen funds harder to trace.
Why does moving funds to Tornado Cash matter?
Tornado Cash has been sanctioned by U.S. authorities for its past use in laundering funds tied to hacking groups, so large transfers there often draw scrutiny from regulators and blockchain investigators.
Has Drift Protocol confirmed the exploit?
Available reporting focuses on the exploiter's wallet activity and fund movements to Tornado Cash, without a detailed public statement from Drift Protocol on the exploit's full scope.
