Cash

Drift

ZachXBT

Tornado Cash

Tornado

<p class="is-style-lead">A wallet tied to the $285 million Drift Protocol exploit moved 23,095.1 Ether, worth about $44.4 million, into Tornado Cash after roughly three months of inactivity.</p><div id="cn-block-summary-block_9e50b2e5022d5214959e23048b40c01e" class="cn-block-summary"><div class="cn-block-summary__nav tabs"><span class="tabs__item is-selected">Summary</span></div><div class="cn-block-summary__content"><ul class="wp-block-list"><li>Drift’s exploiter deposited 23,095 ETH into Tornado Cash after remaining inactive for three months.</li><li>ZachXBT declined further tracking, citing resources required to monitor and freeze a nine-figure DPRK theft.</li><li>Drift previously announced a recovery bounty program with Arkham and Bybit, contrary to online claims.</li></ul></div></div><p>The same address sent 0.85 ETH to wallets labeled as Bybit deposit addresses, <a href="https://etherscan.io/address/0xbddae987fee930910fcc5aa403d5688fb440561b" rel="noopener noreferrer nofollow">according</a> to Etherscan records and monitoring attributed to PeckShield.</p><p>Transfers began on July 23 and continued into July 24, on-chain records show. Researcher JL, known as 0xJaelle, <a href="https://x.com/0xJaelle/status/2080526443407159466" rel="noopener noreferrer nofollow">flagged the movement</a> and tagged ZachXBT. The investigator replied that he did not plan to keep following the funds without institutional support.</p><figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper"><blockquote class="twitter-tweet"><p>The drift exploiter moving funds finally.<br><br>Something <a href="https://x.com/zachxbt?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@zachxbt</a> and <a href="https://x.com/tayvano_?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@tayvano_</a> may want to keep an eye out.<a href="https://t.co/32V67hQaGi" rel="noopener noreferrer nofollow">https://t.co/32V67hQaGi</a></p>— JL (@0xJaelle) <a href="https://x.com/0xJaelle/status/2080526443407159466?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 24, 2026</a></blockquote></div></figure><p>You might also like: <a href="https://crypto.news/rlusd-gets-ripple-mint-and-notabene-boost-as-volume-drops/" rel="noopener noreferrer nofollow"> Bitcoin miner Poolin enters Chapter 11 with $52M bid for Texas assets </a></p><h2 class="wp-block-heading" id="strong-drift-exploiter-empties-an-ethereum-wallet-strong"><strong>Drift exploiter empties an Ethereum wallet</strong></h2><p>The Etherscan address labeled “Drift Exploiter 4” processed hundreds of transactions during the movement. Records show repeated deposits of 100 ETH, 10 ETH and 1 ETH into the Tornado Cash router. Four other transfers totaling 0.85 ETH went to addresses labeled as Bybit deposits.</p><p><a href="https://t.me/s/OnchainLens" rel="noopener noreferrer nofollow">Onchain Lens</a> first reported that the attacker had resumed activity and was sending 100 ETH batches into the mixer several times per minute. The wallet had remained largely inactive since the April attack.</p><p>Tornado Cash pools deposits and permits later withdrawals through different addresses. That can weaken the direct public link between sending and receiving wallets. Investigators may still use timing, transaction patterns and exchange activity, but the process requires more data and staff.</p><p>The movement covers only part of the original theft. Drift’s <a href="https://www.drift.trade/updates/incident-recovery-update-april-16-2026-now" rel="noopener noreferrer nofollow">April recovery update</a> valued stolen assets at $295.7 million across JLP, USDC, Bitcoin-linked tokens, SOL, WETH and other assets. The protocol said much of the converted value remained across four flagged Ethereum wallets.</p><h2 class="wp-block-heading" id="strong-zachxbt-cites-cost-of-tracking-north-korea-linked-funds-strong"><strong>ZachXBT cites cost of tracking North Korea-linked funds</strong></h2><p>ZachXBT wrote, “Sorry I currently do not have any plans to track these funds further.” He said monitoring a nine-figure North Korea-linked exploit and working toward possible freezes would require resources beyond one independent investigator.</p><p>He described the task as “difficult for a team and not feasible for a single person.” ZachXBT also said Drift was not a donor or client. His<a href="https://x.com/zachxbt/status/2080534125082182017" rel="noopener noreferrer nofollow"> response on X</a> drew attention to the cost of investigations that continue for months.</p><p>The comments do not show that no organization is watching the wallets. Drift has said it works with law enforcement, Mandiant and blockchain intelligence firms. Etherscan continues to label the address, while exchanges can review deposits connected to flagged wallets.</p><p>Elsewhere, ZachXBT <a href="https://crypto.news/circle-faces-heat-from-zachxbt-over-inaction/" rel="noopener noreferrer nofollow">criticized</a> Circle after about $232 million in stolen USDC crossed from Solana to Ethereum during the April attack. The funds moved through Circle’s cross-chain system before the attacker converted much of the value into ETH.</p><h2 class="wp-block-heading" id="strong-drift-had-announced-a-recovery-bounty-program-strong"><strong>Drift had announced a recovery bounty program</strong></h2><p>JL later said it was surprising that Drift had not created a recovery bounty. Drift’s public record shows that it had announced plans for one. On April 16, the protocol said it was developing a bounty program with support from Arkham and Bybit.</p><p>However, the update did not provide a final reward amount, eligibility rules or payment schedule. It remains unclear whether the program became fully active, whether it covered continuing wallet monitoring, or whether independent researchers could claim payment for later tracing work.</p><p>Drift also created a user recovery plan separate from stolen-fund tracking. Tether proposed up to $127.5 million in support. Drift plans to issue recovery tokens and fund redemptions through remaining assets, partner capital and future exchange revenue.</p><p>The protocol’s <a href="https://www.drift.trade/updates/drift-recovery-update-june-3-2026" rel="noopener noreferrer nofollow">June investigation update</a> said Mandiant attributed the attack to UNC6862, a North Korean threat group. Drift said the attackers used social engineering and compromised operational access rather than a smart contract flaw. As crypto.news <a href="https://crypto.news/drift-protocols-285m-hack-exposes-social-engineering-threat-to-solana-defi/" rel="noopener noreferrer nofollow">reported</a>, the attackers emptied key vaults within about 12 minutes.</p><h2 class="wp-block-heading" id="strong-recovery-continues-as-the-trail-becomes-harder-to-follow-strong"><strong>Recovery continues as the trail becomes harder to follow</strong></h2><p>Drift has focused on rebuilding its platform and funding user claims while forensic teams pursue the stolen assets. Its recovery framework states that recovered funds will enter the user recovery pool. The protocol also plans stronger signing controls for critical transactions.</p><p>The April attack affected other Solana projects. As previously reported, yield platform Carrot <a href="https://crypto.news/carrot-protocol-to-shut-down-after-drift-breach-wipes-out-tvl/" rel="noopener noreferrer nofollow">decided</a> to shut down after losses linked to Drift erased most of its deposited value.</p><p>The Tornado Cash deposits do not prove that the attacker converted the ETH into usable cash. The deposits remain public, and investigators may still identify later withdrawals. However, they remove a simple wallet-to-wallet trail and make the next phase harder.</p><p>Neither Drift nor Solana had publicly responded to ZachXBT’s comments at the time of writing. Bybit had not announced whether it reviewed the small deposits shown on Etherscan. The remaining stolen funds and the status of Drift’s planned bounty program remain unresolved.</p><p>You might also like: <a href="https://crypto.news/mubadala-tokenizes-75m-private-fund-as-coinbase-buys-in/" rel="noopener noreferrer nofollow"> Mubadala tokenizes $75M private fund as Coinbase buys in </a></p>

Drift exploiter moves $44M through Tornado Cash after months

Table of Contents

crypto.news

Other articles published on Jul 24, 2026

Bitwise CIO Identifies Hyperliquid and Robinhood as Catalysts for Bitcoin’s (BTC) Next Rally

Tech stocks hammered as Tesla, Alphabet disappoint on AI spending; oil tops $100, yields near 4.7%

How Crypto Casinos and Sportsbooks Are Reshaping Online Gambling

Digital Assets Week London Returns with Record Institutional Involvement

Disney (DIS) and Kraft Heinz (KHC) Stocks: Theme Park Food Deal Announcement

PhotonPay Releases Emerging Markets Payment Report: Unlocking Africa's B2B Potential Through Mult...

Join our free newsletter for daily crypto updates!