An address tied to the Drift exploit has moved 23,095 ETH worth roughly $44.4 million into Tornado Cash, a movement of funds visible on-chain that marks a step away from any recovery of the stolen assets rather than toward one.
What the on-chain movement shows
The transfer involved 23,095 ETH valued at about $44.4 million, routed from a wallet associated with the exploiter through the Tornado Cash mixing service. For related coverage, see Dash Says Crypto Forgot Its Original Killer App: Digital Cash.
The “Drift exploiter” refers to the actor behind the incident that drained funds from the Drift platform, whose proceeds on-chain trackers have been following since the event. This latest activity is a movement of those proceeds, not a return of them. For related coverage, see Best Crypto Tax Software in 2026: 8 Tools Compared for Beginners, Traders, and DeFi Users.
A related receiving address active in the same window can also be reviewed on the block explorer, allowing readers to verify the flow directly rather than rely on a summary. For related coverage, see Best Stablecoins in 2026: 7 Stablecoins Compared for Safety, Liquidity, and Yield.
ON-CHAIN DATA
- Address: 0xbddae987…440561b (Drift exploiter)
- Amount moved: 23,095 ETH (~$44.4M)
- Destination: Tornado Cash mixer
Why routing ETH through Tornado Cash matters
Tornado Cash is a mixing service that pools deposits and lets users withdraw to fresh addresses, breaking the visible link between source and destination on the Ethereum ledger. For related coverage, see Top RWA Crypto Projects in 2026: 10 Real-World Asset Tokens and Protocols to Know.
Sending exploit proceeds into a mixer complicates tracing and attribution, since analysts can observe the deposit but cannot follow individual funds cleanly to their eventual withdrawal. Large deposits of this kind typically draw added scrutiny from on-chain investigators.
It is worth distinguishing observed movement from proven end use. The transfer into the mixer is visible and verifiable; what happens to the funds afterward is not yet established from the available on-chain record.
What it means for Drift and investigators
A movement of this size lowers expectations around recovery, because assets pushed through a mixer are materially harder to seize or return than funds sitting in a traceable wallet.
The activity is directly relevant to investigators tracking exploit proceeds, who monitor exploiter wallets precisely for signals like a shift into mixing infrastructure. The same monitoring dynamic followed the earlier Drift hack and its wider Solana security fallout.
The episode reinforces ongoing security and compliance concerns across crypto platforms. The next items to watch are whether the mixed funds surface at identifiable withdrawal addresses and whether Drift or law enforcement issue any formal response tied to the flagged wallet.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
