Six months after one of decentralized finance's most damaging exploits, the attacker behind the Drift protocol hack is moving fast — and moving big. On-chain data shows that wallets linked to April's $295 million breach pushed $109 million worth of Ether into Tornado Cash over just two days, with a single $46 million transfer recorded on Wednesday alone. Even after that flurry of activity, the attacker's addresses still hold an estimated $138 million in Ether, meaning the laundering operation is very much still in progress.
The scale of this movement is difficult to overstate. Shifting $109 million through a mixing protocol within 48 hours represents one of the most aggressive post-exploit laundering runs the Ethereum ecosystem has witnessed in recent memory. It suggests the attacker is either feeling pressure — from on-chain trackers, law enforcement, or both — or has simply reached a point where sitting on idle stolen funds carries more risk than the noise that large mixer deposits inevitably generate.
Tornado Cash as the Laundering Instrument of Last Resort
The choice of Tornado Cash is both predictable and telling. Despite the U.S. Treasury's sanctions against the protocol and ongoing legal proceedings that have defined its turbulent existence, the mixer remains operationally active on Ethereum and continues to be the tool of choice for large-scale theft obfuscation. For an exploiter sitting on nearly $300 million in stolen ETH, there are few alternatives at this volume that offer comparable on-chain anonymity. Privacy coins and cross-chain bridges can obfuscate trails, but for raw Ether at nine-figure quantities, Tornado Cash remains uniquely capable — and uniquely dangerous for the broader regulatory conversation around DeFi infrastructure.
Blockchain analytics firms have spent years developing heuristics to trace funds through Tornado Cash deposits, clustering withdrawal patterns, timing correlations, and gas price behaviors. Yet the fact that $138 million remains in identifiable attacker wallets suggests either confidence in the mixer's obfuscation effectiveness, a deliberate pacing strategy, or both. Moving everything at once would create even louder on-chain signals; spreading withdrawals over days or weeks is the operational playbook for sophisticated actors.
What the $138 Million Remainder Tells Us
The residual balance is arguably as significant as what has already been moved. With $138 million still sitting in wallets that are actively monitored and publicly flagged by the blockchain security community, every subsequent movement becomes a forensic data point. Exchanges that remain compliant with anti-money laundering obligations have presumably flagged addresses associated with the Drift exploit across their screening systems. The practical off-ramp options for the attacker continue to narrow with each passing week — even as the nominal dollar value of the holdings fluctuates with Ether's price.
The April exploit itself — which drained $295 million from Drift, a Solana-based perpetuals trading protocol — was among the largest DeFi hacks of the year by absolute dollar value. The fact that nearly half of those funds appear to have now been processed through a mixer, while another substantial tranche remains accessible to the attacker, underscores a persistent structural problem: DeFi protocols can be exploited at extraordinary scale, and the path from stolen funds to usable liquidity, though increasingly difficult, remains navigable for sufficiently sophisticated actors.
The Broader Infrastructure Warning
For the DeFi industry, Wednesday's data is a stress test of a different kind — not a technical exploit, but a test of whether post-breach forensics, cross-protocol coordination, and regulatory pressure can actually constrain an attacker operating in plain sight on a public blockchain. So far, the answer is ambiguous. On-chain trackers identified the movement almost instantly. The community is watching. And yet $109 million moved in two days, and $138 million remains.
Institutional participants who have been cautiously expanding their DeFi exposure should read this episode carefully. The Drift hack and its aftermath illustrate that the gap between identifying an attacker and meaningfully impeding their ability to liquidate stolen assets remains wide. Better smart contract auditing reduces the frequency of hacks; it does not, by itself, solve what happens in the months that follow a successful exploit. The on-chain accountability that blockchain proponents rightly celebrate as a transparency advantage has not yet translated into reliable asset recovery at this scale. Until it does, nine-figure exploits with extended laundering windows will remain a structural feature of the DeFi landscape, not an anomaly.
Written by the editorial team — independent journalism powered by Bitcoin News.