A wallet labeled “Dr Exploiter 5” by Etherscan has sent funds to Tornado Cash, a privacy protocol operating on the Ethereum blockchain. Unconfirmed reports put the total transferred across multiple transactions at 25,710 ETH. On-chain records independently confirm at least one deposit, renewing questions about the movement and possible recovery of funds associated with the Drift Protocol exploit.

Confirmed On-Chain Activity

Etherscan records show a successful deposit transaction on October 20, 2026, at 09:21:35 UTC. The sender was the address Etherscan identifies as “Drift Exploiter 5”: 0xaa843ed65c1f061f111b5289169731351c5e57c1.

The wallet had accumulated 316 transactions and carried a “Drift Exploit” tag on Etherscan. The confirmed transaction sent 10 ETH to the Tornado.Cash: Router contract at 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b. The internal transfer proceeded directly into Tornado Cash’s 10 ETH pool, which uses a fixed-denomination deposit mechanism intended to obscure the funds’ origin.

Etherscan’s historical fiat display valued the 10 ETH transaction at $24,572.10 at the time of the transfer.

The 25,710 ETH figure cited in reports is based on a single source and could not be independently verified at the time of publication. It should therefore be treated as reported rather than confirmed. The blockchain evidence establishes a pattern of outgoing transfers from the labeled wallet to the Tornado Cash router address, but does not independently substantiate the reported aggregate total.

Why the Transfers Are Being Monitored

Tornado Cash is a privacy protocol implemented through smart contracts, or automated programs that run on Ethereum. Its design is intended to break the visible on-chain connection between a sender and a recipient. After depositing ETH into Tornado Cash, a user receives a cryptographic proof and can later use it to withdraw the same amount to a different address. This makes the original source of the funds substantially more difficult to trace.

The protocol also carries a contested regulatory history. The U.S. Treasury sanctioned Tornado Cash in August 2022, prohibiting U.S. persons from transacting with it, before removing the designation in March 2025 after a federal appeals court ruled that its immutable smart contracts were not property and could not be blocked under U.S. sanctions law. Developers associated with the protocol have separately faced criminal proceedings in the Netherlands and the United States. That legal backdrop is part of why deposits from exploit-labeled wallets draw sustained attention from compliance teams and on-chain forensics firms.

The use of privacy technology is not inherently criminal. Some users employ privacy tools for legitimate purposes, including protecting the confidentiality of business transactions. However, on-chain investigators and security researchers closely monitor transfers from wallets labeled as being connected to exploits because routing funds through a mixer can make stolen assets more difficult to recover or attribute.

Following its hack, Drift Protocol — a decentralized perpetuals exchange built on the Solana blockchain — opened recovery claims for affected users. Transfers of this type can place potentially recoverable assets further out of reach. Funds routed through Tornado Cash are generally more difficult to freeze, return, or link to a particular party, which is why security companies track activity involving wallets associated with exploits.

An Etherscan label is not a court finding. “Drift Exploiter 5” indicates that on-chain investigators have associated the address with the Drift exploit; it does not mean that a legal process has reached that conclusion. The destination address by itself also does not establish intent or illegal activity under any particular jurisdiction.

What Investigators Will Watch Next

Blockchain security researchers are expected to watch for several follow-up signals. One is whether additional transactions from the same labeled wallet appear on Etherscan in the hours or days following the confirmed deposit. Exploit-related wallets may make multiple deposits instead of one large transfer because Tornado Cash pools use fixed denominations; its 10 ETH pool accepts 10 ETH at a time.

Withdrawal activity is another area of focus. A Tornado Cash deposit becomes useful to an illicit actor only when the corresponding funds are withdrawn to a new address. Although that step is more difficult to detect, it is not impossible. Firms including Chainalysis and TRM Labs have developed heuristics intended to identify probable withdrawal addresses.

Investigators will also look for a public statement from Drift Protocol or an affiliated security team linking the wallet to the original exploit and providing additional detail about the on-chain evidence. No such statement was available at publication time. Until that evidence is provided, the 25,710 ETH figure remains unconfirmed.

Ethereum was trading at $2,457.21, up 2.19% over the previous 24 hours, with a market capitalization above $300 billion. The broader crypto Fear and Greed Index stood at 55, representing a “Greed” reading and indicating that market participants were described as risk-on. The source reported that security incidents of this type generally have limited short-term price impact unless the amounts involved are large enough to cause protocol insolvency, which it said was not the case here.

The Drift recovery process opened at 1% of verified losses. Confirmed mixer activity from a wallet labeled as an exploiter is relevant context for affected users assessing the prospects of fuller restitution. Users with assets on Drift Protocol should look for official communications from the Drift team concerning recovery claims and the status of the stolen funds.

The incident also illustrates the limits and capabilities of on-chain transparency. Anyone can observe that the wallet made a deposit to a specific contract at a specific time. The blockchain cannot, by itself, establish who controls the wallet. That gap between transaction visibility and real-world accountability is central to the investigation of large crypto exploits and to ongoing efforts involving wallet security and fund tracing.

Other reported large-scale hacks, including the $388 million hack that prompted Bitget’s plans to acquire a Thai exchange, demonstrate the broader pattern of illicit fund movement that on-chain forensics teams are working to counter.

Source: CoinLineup

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital markets carry significant risk. Always conduct your own research before making decisions.