The wallet linked to the Drift protocol exploit has deposited another batch of stolen funds, according to blockchain security firm PeckShield, extending a documented pattern of incremental fund movements tied to the incident. The latest activity signals that on-chain tracing of the exploiter's holdings remains an active concern for the decentralized finance (DeFi) ecosystem.

PeckShield flagged the deposit in a post on X via its @PeckShieldAlert account, warning followers that the Drift exploiter had made an additional transfer of stolen assets. Alerts from on-chain security firms such as PeckShield and Chainalysis are frequently the first public indication that funds from a known exploit are on the move, since flagged addresses can be monitored continuously as new transactions settle.

PeckShieldAlert: #Drift Exploiter has deposited another batch of stolen funds

— PeckShieldAlert (@PeckShieldAlert) October 2026

Source: @PeckShieldAlert on X

The alert adds to a documented pattern of incremental fund movements from the address, consistent with transfers made in batches rather than a single movement of the entire balance, as the exploiter continues to redistribute or obscure stolen assets across multiple wallets. Moving funds in smaller tranches is a recognized pattern in post-exploit laundering, as individual transfers are less likely than one large movement to trigger the monitoring thresholds that exchanges and compliance teams apply to deposits.

Another Deposit in a Pattern of Incremental Movement

The phrase "another batch" in PeckShield's alert is significant: it confirms this is not the first reported movement of stolen funds from the address. Earlier tracking showed the exploiter had already moved 23,095 ETH into Tornado Cash, using the privacy protocol as a standard obfuscation layer for large illicit transfers. The protocol pools deposits from many users and permits withdrawals from addresses with no direct on-chain link to the originals, which is why transfers into it are treated by analysts as a break point in fund tracing. The latest deposit follows that established operational pattern.

Chainalysis previously identified a stopover wallet in the fund flow, consistent with the multi-hop routing strategies used to complicate on-chain attribution. The address associated with the Drift exploiter can be queried directly on Etherscan, where the publicly viewable transaction history reflects the series of outbound movements that security researchers have been monitoring since the original incident.

Prior to this latest deposit, the exploiter's wallet had accumulated more than 130,262 ETH after purchasing an additional 1,195 ETH on the open market, an unusual move that suggested the address remained operationally active rather than dormant.

What Continued Movement Means for Tracing Efforts

Each additional deposit complicates attribution, but it also generates new on-chain evidence. Every transaction from the exploiter's known address extends the traceable graph that blockchain analytics firms use to map fund flow across wallets, exchanges, and mixing services. A fresh deposit is therefore both a risk event and a data point.

The operative question for investigators is whether the destination of this latest batch is a known exchange deposit address, a newly created intermediary wallet, or a privacy protocol. None of those details has been confirmed in the current reporting. Until the destination and the amount are independently verified against on-chain records, the scope of this specific movement remains unquantified.

The Drift exploiter's resumed activity after an earlier period of apparent dormancy has already drawn attention from analytics firms. Continued deposits indicate that the exploiter has not halted operations, a development that typically raises the urgency of any active tracing or legal coordination involving the affected protocol and law enforcement.

What Remains to Be Confirmed

Several material details are outstanding as of this reporting. The specific amount deposited in the batch has not been confirmed. The destination wallet or platform has not been publicly identified. No official statement from the Drift protocol team or a relevant law enforcement agency has been issued in connection with this specific movement.

Verifiable confirmation of the deposit would require a transaction hash linked to the known exploiter address, a USD-equivalent amount at the time of transfer, and identification of the receiving address or contract. Those details should be traceable through Etherscan once the specific transaction is identified and made public by security researchers. Until then, follow-up alerts from PeckShield or other analytics teams remain the most likely public signal of where the newly deposited funds move next.

Future updates on this story should be anchored in verifiable on-chain records or statements from the parties directly involved in the incident response. The original exploit, which resulted in $285 million in losses to the Drift protocol, established the baseline for all subsequent fund tracking, and any confirmed movement reduces the total unaccounted balance that investigators are working to trace.