A wallet suspected of links to the Drift protocol exploit has routed $61.6 million worth of Ethereum into Tornado Cash, roughly two months after the alleged incident that first placed the address under scrutiny.

Suspected Drift Exploiter Sends $61.6 Million in ETH to Tornado Cash

On-chain data shows the wallet at address 0x22aaA7…5C2C directing a large volume of Ether into Tornado Cash. Tornado Cash is a privacy tool built on Ethereum that pools deposits from many users and later permits withdrawals to fresh addresses, making it difficult to trace where the funds originated.

The wallet has not been officially confirmed as belonging to any individual. Blockchain researchers and security observers characterize the connection to the Drift exploit as suspected rather than proven — the "suspected exploiter" label is an inference drawn from transaction patterns, not a legal identification.

Nor is this the first movement of funds tied to the suspected Drift incident. Earlier, a suspected Drift exploiter routed 23,095 ETH through Tornado Cash, and in a separate transfer a wallet labeled "Drift Exploiter 5" sent 25,710 ETH to the same mixer. Taken together, the amounts are substantial: Drift exploiter-linked wallets had already sent $109 million to Tornado Cash before this latest transfer, bringing the running total tied to wallets linked to the incident to roughly $170 million.

Transfer Comes Two Months After the Alleged Incident

The timing is what makes this particular movement notable. A delay of roughly two months is a pattern observers have flagged in past crypto exploit cases, since it allows immediate attention to die down before funds are moved. That observation, however, is not proof of wrongdoing by any specific person.

Drift is a decentralized trading protocol built on the Solana blockchain. After the alleged exploit, the platform opened a process for affected users to recovery claims. That recovery claims process was initially set at 1% of verified losses, indicating the scale of the shortfall between available funds and what users reportedly lost.

Why the Tornado Cash Transfer Is Being Watched

Tornado Cash functions like a cash-mixing service: money goes in from one wallet, and an equivalent amount comes out to a different wallet, breaking the on-chain trail. The US Treasury's Office of Foreign Assets Control sanctioned Tornado Cash in August 2022, citing its use in laundering more than $7 billion in cryptocurrency since 2019 — a designation that, at the time, barred US persons from transacting with the mixer. A US federal appeals court later held that sanctioning the protocol's immutable smart contracts exceeded OFAC's authority, and Tornado Cash was removed from the Treasury's sanctions list in March 2025, though flows through the protocol remain a recurring focus of on-chain investigations.

Using a privacy mixer does not, by itself, prove the sender committed a crime. Privacy tools have legitimate uses, and the wallet flagged here carries a "suspected" label precisely because its link to the Drift incident has not been confirmed by any authority.

What observers can say is that a large sum of ETH from a wallet under scrutiny has now been routed through a protocol specifically designed to obscure transaction origins. Because deposits into and withdrawals out of the mixer are recorded on Ethereum's public ledger, researchers can continue to track the funds' footprint — including whether they later exit to newly created addresses — even as the direct link between source and destination is obscured. That fact alone explains why the movement is drawing attention from the on-chain security community.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always conduct your own research before making any decisions.

Source: CoinLineup