Whoever's behind the $295M Drift exploit back in April is still methodically laundering funds, pushing $109M in ETH through Tornado Cash over just two days, including $46M on Wednesday alone. Even after that, the linked wallets are sitting on $138M more in Ether. Mixing this much volume rarely stays quiet for long — worth watching where the rest of this stash ends up.
A Slow-Motion Laundering Operation
Wallets tied to the April exploit of Drift have continued moving stolen funds into Tornado Cash, a cryptocurrency mixer, according to Cointelegraph. Over a two-day stretch, $109 million worth of Ether was sent to the mixer, with $46 million of that total moving in a single day on Wednesday. Even after those transfers, the wallets linked to the exploit still held $138 million in Ether, suggesting the person or group behind the hack is working through a much larger stash in stages rather than all at once.
The original exploit, which Cointelegraph notes was worth $295 million back in April, remains one of the larger incidents in recent crypto history. The fact that funds are still being moved months later shows how long the aftermath of a major hack can stretch on, as attackers try to convert stolen assets into something usable without drawing immediate attention.
What Tornado Cash Actually Does
Tornado Cash is a mixing protocol built on Ethereum that breaks the on-chain link between a sender and a receiver. Users deposit crypto into a shared pool and later withdraw an equivalent amount from that same pool, making it far harder for blockchain analysts to trace where specific funds originated or ended up. Mixers like this are a normal part of the crypto privacy toolkit, but they are also the most common route exploiters use to try to cash out stolen assets, since moving large sums directly to an exchange would be an easy flag for investigators.
Because transactions on Ethereum are public, firms that track stolen funds can still watch wallets known to be connected to a hack, even if the ultimate destination of the money becomes harder to pin down once it passes through a mixer. That is effectively what is happening here: outside observers can see the wallets, see the amounts moving, and see what is left, even without knowing who controls them or where the funds go next.
Why the Remaining Balance Matters
The $138 million still sitting in these wallets after the latest transfers means the laundering process is far from finished. Large, repeated movements of this kind tend to attract continued attention from blockchain analysts, security researchers, and exchanges, who often flag addresses linked to known exploits to prevent withdrawals or trading of tainted funds.
What This Means for Spot Traders
For spot traders, this situation is primarily a market-awareness issue rather than a trading signal. Large volumes of Ether moving through a mixer do not by themselves indicate price direction, and there is no stated price reaction tied to these transfers. What matters more is staying aware that significant hack-related flows are still working their way through the system, since sentiment around a major protocol's security incident can occasionally ripple into broader market mood.
As with any news driven by uncertain, evolving events, patience and a steady approach such as spreading out entries over time can help traders avoid reacting impulsively to headlines about ongoing laundering activity, since the full picture, including where the remaining funds ultimately end up, is still unfolding.