The wallet tied to the April Drift exploit sent $109 million in Ether to Tornado Cash across two days, including a $46 million transfer on Wednesday, according to blockchain records. The original hack drained $295 million from the platform. After the latest move, wallets linked to the attack still hold $138 million in Ether.
Two days of mixer transfers
The transfers started earlier this week and continued into Wednesday, with the largest single batch of $46 million routed to the sanctioned cryptocurrency mixer. Tornado Cash lets users pool and withdraw funds in a way that obscures the on-chain trail, which is why it's a common stop for stolen assets. The $109 million total represents a little more than a third of what was taken in April.
What's left matters just as much. The $138 million still sitting in linked wallets is roughly 47% of the original haul, assuming no other assets were moved or converted outside the Ether flows tracked so far. That remaining balance gives investigators and the platform something to watch — and gives the exploiter a reason to keep moving funds in smaller pieces.
Why the mixer matters
Tornado Cash isn't a neutral mixing service in the eyes of U.S. authorities. The Treasury's Office of Foreign Assets Control sanctioned the protocol in 2022, making it illegal for U.S. persons to use it. That designation has been contested in court, but it hasn't stopped hackers from routing stolen crypto through the service. For Drift, the Wednesday transfer is a signal that the exploiter is actively trying to break the chain between the stolen funds and their origin.
Once Ether goes into Tornado Cash, it comes out in smaller amounts to fresh addresses. Tracing those withdrawals is possible but time-consuming, and it often depends on whether the exploiter makes a mistake — reusing an address, cashing out through a centralized exchange, or moving funds to a service that cooperates with law enforcement.
The $138 million still in play
The wallets linked to the hack aren't empty. Holding $138 million in Ether after Wednesday's transfer means the exploiter still controls a substantial portion of the proceeds. That balance is a moving target: it could shrink with another mixer run, or it could grow if the exploiter swaps into other tokens or waits for price moves.
For Drift, the recovery picture remains uncertain. The platform hasn't said publicly whether it's working with blockchain analytics firms or law enforcement on the remaining funds, and there's no indication yet that any of the mixed Ether has been frozen or recovered. The April hack was one of the larger DeFi breaches this year, and the slow, deliberate movement of funds suggests the exploiter isn't in a hurry.
What to watch next
The most immediate question is whether the remaining $138 million stays put or follows the same path into Tornado Cash. Each transfer gives investigators another data point, but it also gives the exploiter another layer of separation. Drift users and the platform's creditors will be watching the wallets for any sign of a cash-out attempt — a move to a centralized exchange would be the clearest opening for a freeze. Until then, the funds sit in limbo, and the mixer's deposits keep growing.
