Drift Protocol Hackers Move 13,400 Ethereum (ETH) Into Tornado Cash
Key Takeaways
- •Wallets tied to the Drift Protocol hack sent 13,400 ETH to Tornado Cash, according to on-chain monitoring.
- •Identified attacker-linked addresses hold approximately $224.59 million across ETH, USDY, and SOL.
- •The holdings include 93,965 ETH, 477,375 USDY tokens, and 1.33 SOL.
- •OFAC sanctioned Tornado Cash in August 2022, restricting transactions by U.S. persons.
- •Drift Protocol operates a Solana-based decentralized exchange and previously reimbursed users after a separate $260,000 exploit in May 2024.
Attackers linked to the hack of Drift Protocol have moved 13,400 Ethereum (ETH) into Tornado Cash, according to on-chain monitoring data, continuing the movement of funds stolen in the exploit. Tracking of this kind is possible because blockchains keep public ledgers, allowing analysts to follow transfers as they move between identifiable addresses.
A breakdown shared in the Onchain Lens record shows how the remaining loot is currently held: the attacker-linked addresses carry 93,965 ETH, worth about $224.04 million, alongside 477,375 Ondo US Dollar Yield (USDY) tokens valued near $548,980 and a residual balance 1.33 SOL. Combined, the tracked holdings amount to approximately $224.59 million, and as long as those holdings remain in identifiable addresses, their movements stay visible on-chain.
Routing Through a Sanctioned Mixer
Tornado Cash is an Ethereum-based mixing protocol that pools deposits and withdrawals to obscure the origin of funds passing through it. The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) placed the service under sanctions in August 2022, barring U.S. persons from transacting with it, and cryptocurrency stolen in hacks is routinely routed through the mixer before being withdrawn to fresh addresses that are more difficult to trace. Deposits of this size, such as the 13,400 ETH moved by the Drift Protocol attackers, are recorded permanently on the public ledger even when the eventual withdrawals become harder to attribute.
Background: Drift Protocol and USDY
Drift Protocol is a decentralized exchange for perpetual futures and spot trading built on the Solana blockchain. The protocol previously experienced a security incident in May 2024, when an attacker exploited a flaw in its margin and borrow functionality to extract roughly $260,000 in funds; Drift subsequently moved to reimburse affected users. That amount is a fraction of the roughly $224.59 million now tracked in addresses tied to the current exploit.
USDY is a tokenized, yield-bearing U.S. dollar product issued by Ondo Finance, backed by short-term U.S. Treasuries and bank deposits.
2026-10-20 COINOTAG | Update 20:12 UTC
This content was first published on COINOTAG: https://en.coinotag.com/drift-hackers-move-13400-ethereum-eth-tornado-cash
