Security

Tornado

Tornado Cash

Drift

Cash

Blockchain security firm PeckShield has flagged a deposit to Tornado Cash originating from an address labeled as the Drift exploiter, raising fresh concerns about the movement of funds tied to one of crypto’s largest protocol hacks.
PeckShield, which routinely monitors on-chain activity for exploit-linked wallets, issued the alert after detecting the transfer. The firm identified the sender as an address carrying the “Drift exploiter” label, a designation used in on-chain tracking to flag wallets believed to be connected to the attack on the Drift Protocol. For related coverage, see <a href="https://www.theccpress.com/jpmorgan-jpm-coin-deposit-token-ethereum/" rel="noopener noreferrer nofollow">JPMorgan Expands JPM Coin Deposit Token to Ethereum</a>.
The deposit destination, Tornado Cash, is a privacy protocol on Ethereum that obscures transaction trails by pooling and redistributing funds. Security researchers and law enforcement agencies have long flagged it as a tool used to complicate the tracing of stolen assets. For related coverage, see <a href="https://www.theccpress.com/swiss-regulator-clears-first-retail-bitcoin-etf/" rel="noopener noreferrer nofollow">Swiss Regulator Clears First Retail Bitcoin ETF</a>.
<h2 id="what-the-drift-exploiter-label-actually-means">What the “Drift Exploiter” Label Actually Means</h2>
It is important to understand what an address label is, and what it is not. When PeckShield or other on-chain monitoring services attach a label like “Drift exploiter” to a wallet, they are applying an attribution based on prior transaction patterns or community analysis, not making a legal determination about identity or ownership.
The address flagged in PeckShield’s alert can be reviewed on <a href="https://etherscan.io/address/0xd90e2f925da726b50c4ed8d0fb90ad053324f31b" rel="noopener noreferrer nofollow">Etherscan</a>, where on-chain activity and any public labels are visible. Labels on Etherscan and similar explorers are community-sourced or platform-applied tags, not verified legal identities.
That distinction matters. Calling a wallet “labeled as” the Drift exploiter is not the same as confirming that the wallet belongs to the attacker, or that the person controlling it is definitively responsible for the exploit. Further investigation would be required to establish those links with any certainty.
PeckShield has flagged similar movements in the past. The firm previously <a href="https://www.theccpress.com/peckshield-2m-dai-phishing-bofur-capital-address/" rel="noopener noreferrer nofollow">identified a $2 million DAI phishing loss linked to an address associated with Bofur Capital</a>, using comparable label-based attribution methods to surface suspicious transactions.
<h2 id="why-this-transfer-is-drawing-scrutiny">Why This Transfer Is Drawing Scrutiny</h2>
When an address tied, even tentatively, to a major exploit moves funds into Tornado Cash, it draws immediate attention from the security community. The combination is a well-recognized pattern: exploit-linked wallets attempting to break the transaction trail before funds can be frozen, identified, or recovered.
Tornado Cash has been at the center of regulatory and legal action precisely because of this dynamic. The protocol was sanctioned by the U.S. Treasury’s Office of Foreign Assets Control in 2022, with authorities arguing it had been used to launder proceeds from hacks including those attributed to North Korea-linked groups.
The Drift Protocol hack itself has attracted serious scrutiny. <a href="https://www.theccpress.com/ledger-cto-suspects-280m-drift-protocol-hack-linked-to-north-korea/" rel="noopener noreferrer nofollow">Ledger’s CTO previously flagged suspicions that the $280 million Drift Protocol hack was tied to North Korea</a>, a claim that adds a geopolitical dimension to any movement of funds from associated addresses.
PeckShield’s alert does not confirm motive, and the firm stopped short of claiming the transfer constitutes laundering or a successful cash-out. What the alert does establish is that an address bearing an exploit-linked label has made an active deposit to a privacy protocol, which warrants monitoring.
Security teams and blockchain analysts will typically watch subsequent transactions from connected addresses closely after such a flag, looking for signs of further obfuscation or attempts to move funds to centralized exchanges where identification might be possible.
PeckShield has built a track record of surfacing these movements before they drop out of the public record. <a href="https://www.theccpress.com/crypto-hack-losses-52m-march-peckshield-report/" rel="noopener noreferrer nofollow">The firm reported that crypto hack losses hit $52 million in March alone</a>, a figure that underlines how frequently exploit-linked wallets remain active long after an initial breach.
<h2 id="what-comes-next">What Comes Next</h2>
The alert puts the address under a sharper spotlight. If the wallet continues to route funds through privacy protocols or attempts to interact with exchange deposit addresses, those movements will likely generate additional flags from monitoring services.
Recovery of funds from exploit-linked wallets after they pass through Tornado Cash is extremely difficult, though not always impossible. Law enforcement agencies and blockchain analytics firms have in some cases been able to follow obfuscated trails when additional on-chain mistakes or exchange KYC interactions expose the underlying flow.
For now, the transfer from the address flagged on Etherscan represents a data point, not a conclusion. PeckShield has done its job in surfacing the activity. Whether investigators can act on it is the question that now hangs over this alert.
Will this deposit mark the beginning of a successful laundering attempt, or will it leave a trail that eventually leads somewhere?
Additional source references: <a href="https://www.google.com/search?q=%222112467387769557111%22" rel="noopener noreferrer nofollow">source document 1</a>.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article <a href="https://www.theccpress.com/?p=49143" rel="noopener noreferrer nofollow">PeckShield Flags Tornado Cash Deposit From Drift Exploiter-Labeled Address</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.

PeckShield Flags Tornado Cash Deposit From Drift Exploiter-Labeled Address

Table of Contents

Cryptocurrency Press

Other articles published on Oct 20, 2026

Join our free newsletter for daily crypto updates!