Wallets reportedly linked to the exploiter behind the Drift protocol hack have sent a combined $109 million to Tornado Cash, according to on-chain data. The transfers have drawn attention from blockchain investigators tracking funds stolen in the Drift exploit, although wallet attribution and the identity of those behind the movements have not been independently confirmed.

What the On-Chain Data Shows

On-chain records for the Ethereum address 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b on Etherscan show activity connected to the reported transfers. The aggregate value cited across wallets allegedly tied to the Drift exploit totals $109 million.

The word "linked" carries an important caveat. Blockchain analytics can trace wallet-to-wallet connections, but those connections do not automatically establish who owns or controls a wallet. Attribution requires additional evidence beyond transaction history alone.

This is not the first time a wallet in this cluster has moved funds in this manner. "Drift Exploiter 5" previously sent 25,710 ETH to Tornado Cash, a movement that drew similar scrutiny from on-chain researchers and established the pattern investigators are now tracking across the broader wallet cluster.

Why Tornado Cash Deposits Matter

Tornado Cash is a privacy protocol built on Ethereum. It pools deposits from many users and allows withdrawals to fresh addresses, breaking the on-chain link between sender and receiver. In effect, it functions as a mixing service: funds go in one end, and unlinked funds come out the other.

When money from a suspected exploit flows into Tornado Cash, tracing where it goes next becomes significantly harder. Investigators, exchanges, and affected users attempting to recover assets lose visibility once deposits are made. That is why the reported transfers carry weight beyond the dollar figure alone.

Using Tornado Cash is not itself illegal in every jurisdiction, and the protocol has legitimate privacy use cases. Its legal status has also been contested at the highest levels: the U.S. Treasury's Office of Foreign Assets Control sanctioned the protocol in August 2022, but the U.S. Court of Appeals for the Fifth Circuit ruled in November 2024 that the Treasury had exceeded its authority over the protocol's immutable smart contracts, and the sanctions were lifted in March 2025. However, directing large sums connected to an alleged exploit into a mixing protocol is a recognized pattern in crypto theft cases. It typically signals that whoever controls the wallets is attempting to obscure the funds' origin.

The Drift Hack and Recovery Efforts

Drift is a decentralized exchange — a trading platform that runs on automated software rather than a central company — built on the Solana blockchain. Following the exploit, the protocol moved to address user losses. Drift opened recovery claims for affected users at 1% of verified losses, a figure that reflects both the scale of the damage and the limits of what the protocol could immediately return.

The gap between what was taken and what was recoverable underscores why tracking these wallets matters. Every transfer into a mixing protocol reduces the realistic chance of recovery for users who lost funds. Because Ethereum records every transaction publicly, any further deposits from addresses in this cluster would be visible on block explorers as they happen — though, as the attribution caveat makes clear, visibility alone rarely settles who is behind them.

What This Means for Regular Crypto Holders

For users not directly affected by the Drift hack, the main takeaway is risk awareness. Decentralized exchanges can hold significant user funds without the insurance protections that traditional banks carry. When exploits occur, recovery is rarely guaranteed, and stolen funds can move quickly to venues where they cannot be traced.

Blockchain transparency means these transfers are publicly visible on Ethereum block explorers, but visibility does not equal accountability. Identifying a wallet is not the same as identifying a person, and mixing protocols widen that gap considerably.

For anyone using DeFi platforms — short for "decentralized finance," meaning financial services run on blockchain software rather than by banks — the case is a reminder to understand the risks before depositing funds. Audits and insurance funds exist, but they do not always cover the full extent of a loss.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always research thoroughly before making any financial decisions.