An address linked to the Drift protocol exploit has transferred 23,095 ETH, valued at approximately $44.4 million, into the Tornado Cash mixing service. The movement is visible on-chain and represents a shift of stolen proceeds further from potential recovery rather than any step toward their return.

On-Chain Movement Details

The transfer involved 23,095 ETH worth roughly $44.4 million, routed from a wallet associated with the Drift exploiter through Tornado Cash. The address in question — 0xbddae987…440561b — has been tracked by on-chain analysts since the original incident that drained funds from the Drift platform. This latest activity constitutes a relocation of those proceeds, not a restitution.

A related receiving address active during the same timeframe can be reviewed on the block explorer at etherscan.io, allowing independent verification of the fund flow.

On-Chain Data Summary:

• Address: 0xbddae987…440561b (Drift exploiter)
• Amount moved: 23,095 ETH (~$44.4 million)
• Destination: Tornado Cash mixer

The sending address can also be viewed directly on Etherscan.

Why Routing Through Tornado Cash Matters

Tornado Cash is a mixing protocol that pools multiple deposits and enables users to withdraw funds to fresh addresses, severing the visible connection between source and destination on the Ethereum ledger. By depositing exploit proceeds into a mixer, the actor complicates tracing and attribution efforts. On-chain investigators can observe the deposit itself but cannot cleanly follow individual funds to their eventual withdrawal point.

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash in August 2022, designating it for its role in laundering cybercrime proceeds, including funds attributed to North Korea's Lazarus Group. Despite the sanctions and subsequent legal actions targeting the protocol's developers, the smart contracts remain deployed and operational on-chain, meaning the mixer can still be interacted with by any address. This regulatory backdrop adds a further layer of legal risk for any actor depositing funds through the service.

Large deposits of this nature typically attract heightened scrutiny from blockchain analytics firms and investigators. It is important to distinguish between observed movement and proven end use: the transfer into the mixer is visible and verifiable, but what becomes of the funds afterward has not yet been established from the available on-chain record.

Implications for Drift and Investigators

A movement of this magnitude diminishes prospects for asset recovery, since funds routed through a mixer are significantly more difficult to seize or return than assets held in a traceable wallet.

The activity is directly relevant to investigators who monitor exploiter wallets specifically for signals such as a shift into mixing infrastructure. A similar monitoring dynamic followed the earlier Drift hack and its broader Solana security fallout.

The episode underscores persistent security and compliance concerns across cryptocurrency platforms, where post-exploit fund laundering through sanctioned infrastructure remains a recurring pattern. Key developments to watch include whether the mixed funds eventually surface at identifiable withdrawal addresses, whether OFAC-listed analytics tools flag downstream recipients, and whether Drift or law enforcement agencies issue any formal response connected to the flagged wallet.