A wallet tied to the April Drift exploit has sent $54.8 million in ETH to Tornado Cash, the sanctioned crypto mixing service. The transfer marks one of the largest single movements of stolen funds since the attack, which hit the Drift protocol earlier this year.
Five other wallets labeled by Etherscan as Drift exploiter addresses still hold roughly 84,164 ETH, according to on-chain data. Those holdings remain untouched for now, leaving recovery efforts with a substantial pool of assets to chase.
Where the funds went
The $54.8 million transfer to Tornado Cash is the clearest sign yet that the attackers are trying to obscure the trail. Tornado Cash lets users deposit and withdraw crypto in a way that breaks the direct link between sender and recipient. That makes it harder for investigators and recovery teams to follow the money.
The move doesn't necessarily mean the funds are gone for good. Recovery efforts are still ongoing, and the five labeled wallets holding 84,164 ETH give those teams something concrete to monitor. Any future movement from those addresses will be visible on-chain, just as this one was.
The wallets still holding ETH
Etherscan's labels on the five wallets are a public marker that these addresses are tied to the exploit. The 84,164 ETH they hold is a large sum by any measure, and it's sitting in plain sight. For now, there's no public indication of what the holders plan to do with it.
Recovery in cases like this often depends on tracking those wallets and reacting quickly if funds start to move. The $54.8 million transfer shows that can happen without warning.
What recovery teams are watching
The April attack set off a recovery process that's still running. Details of how that process is structured aren't public, but the on-chain activity gives a running scorecard. Every transfer from a labeled wallet is a data point.
The Tornado Cash deposit is the biggest so far. It also raises a question recovery teams will have to answer: whether funds sent through a mixer can be traced and recovered at all, or whether that money is effectively out of reach.
Why Tornado Cash matters here
Tornado Cash has been a recurring stop for stolen crypto. Its design is built to hide transaction links, which is exactly what an exploiter wants after a heist. Sending $54.8 million through it is a deliberate step, not an accidental one.
For Drift and the teams working on recovery, the transfer narrows the pot of easily traceable funds. The 84,164 ETH still in the five labeled wallets is now the more visible target. Whether those holdings stay put or follow the same path is the next thing to watch.
