Wallet Cluster Linked to April Drift Exploit Moves $44M of Ether into Sanctioned Tornado Cash

A wallet cluster labeled by on-chain monitoring firms as tied to the April 1 exploit of Drift Protocol has resumed activity after about three months of dormancy, sending roughly 23,095.1 ether, worth about $44.4 million at the time, into Tornado Cash.

The transfers, reported July 23 and 24 by on-chain monitors including Onchain Lens and Arkham and later tallied by blockchain security firm PeckShield, matter because they appear to be a fresh laundering step involving a sanctioned crypto-mixing service, rather than routine movement among wallets.

Early monitoring reports said the address cluster labeled as the “Drift exploiter” began moving funds in repeated 100 ETH deposits made in rapid succession to Tornado Cash, a service designed to obscure the origin and destination of cryptocurrency transactions. PeckShield later reported the cumulative amount sent to the mixer at 23,095.1 ETH.

PeckShield summaries of the same activity also noted a smaller transfer of 0.85 ETH to a Bybit deposit address, though the much larger flow into Tornado Cash was the main development highlighted by monitors.

The underlying hack dates to April 1, 2026, when Drift Protocol, a decentralized finance platform, lost roughly $285 million in user assets in one of the larger DeFi exploits of the year, according to background from Chainalysis and CoinDesk. The current story, however, is not the exploit itself but the apparent effort months later to route part of the stolen cryptocurrency through a mixer.

That distinction is important for compliance and enforcement watchers. Tornado Cash was sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control, the agency that administers and enforces U.S. sanctions, in August 2022. In announcing the move, OFAC said: “Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned virtual currency mixer Tornado Cash.”

Use of Tornado Cash does not by itself prove who controls a wallet, and the “Drift exploiter” label used by monitoring firms is an on-chain analytics attribution, not a court finding. Still, such labels are widely used across the crypto industry to track funds associated with major hacks and exploits.

Several forensic firms have previously said the Drift attack showed tradecraft consistent with sophisticated DPRK-linked or Lazarus-style operations, but that, too, remains analyst attribution rather than a legal determination.

For now, the observable on-chain fact is that wallets identified by monitoring firms as connected to the Drift exploit have become active again after months of silence, and that tens of millions of dollars’ worth of ether has now been funneled into a mixer that has been under U.S. sanctions for nearly four years.