258 Deposits in One Day: Drift Exploiter 5 Empties Its Wallet Into Tornado Cash

The wallet Etherscan tags "Drift Exploiter 5" made 258 separate deposits on October 20. Not 25. Not 80. Two hundred fifty-eight, in one day, and by the end of it the address was essentially cleaned out.

This is the back half of a $63 million heist. The money behind those deposits moved through Tornado Cash, the permissionless mixer that sanctions lawyers loathe and privacy advocates keep defending. Chunking a balance into hundreds of transfers isn't sloppiness. It's the standard counter to clustering heuristics, and whoever is running this wallet understands the tradecraft better than most people understand their own exchange balances.

Here's the part recovery teams don't like to say out loud. Mixers don't make funds invisible. They make them expensive to follow. You can still trace a path through a pool, you just burn time, tooling, and legal effort doing it. At 258 deposits, the cost of chasing the money went up while the odds of clawing it back went down.

Drift's users are stuck in the gap between those two numbers. Recovery claims sound reassuring in a governance post. They're a lot less reassuring when the balance is 258 transactions deep into a mixer and still moving. Nobody at the protocol can subpoena a smart contract. Nobody can freeze a pool that's built not to have an admin key. That's the whole point of the design. And it's the whole problem when you're the one holding the loss.

The uncomfortable takeaway is that permissionless architecture cuts both ways, and it always has. The same properties that let a protocol launch without gatekeepers let an exploiter exit without them. If agents have wallets, who holds the keys? Same question for whoever drained this one. Nobody does.

Watch the withdrawal side of Tornado Cash over the next 60 to 90 days. That's where the trail either gets noisy or goes quiet, and quiet is the outcome worth worrying about.