Drift Exploiter Pushes $109M in Ether Through Tornado Cash in 48 Hours, $138M Still Sitting There

How do you move $295 million in stolen crypto without a bank, a lawyer, or a single phone call? One $46 million batch at a time.

That's what's happening right now. Wallets tied to the April Drift exploit have pushed roughly $109 million in Ether into Tornado Cash over the last two days. Another $46 million went in Wednesday alone. And here's the part that should raise your blood pressure: those same wallets still hold around $138 million in Ether.

JUST IN: the money isn't gone. It's being laundered in real time, on a public ledger, for anyone with a browser to watch.

The Raw Numbers

Let's lay it out. The April hack pulled about $295 million out of Drift. One of the biggest single protocol drains of the year, and it happened fast enough that most people were still arguing about exploit mechanics while the funds were already splitting across dozens of addresses.

Since then, the movement has been methodical. Two days of deposits. About $109 million total in Ether. Forty-six million of that landed Wednesday, the largest single push of the sequence so far.

And $138 million in Ether is still parked in those linked wallets.

Do the math on pace. If the pattern holds, the rest of it walks out the door in a few more sessions. Maybe sooner. Whoever's running these addresses isn't being careful anymore. They're being quick.

Worth flagging, those dollar figures float. Ether moves, so $109 million today could be $95 million or $125 million by the time the next batch clears. The token count is what's real.

The market's verdict: this is a laundering schedule, not a cautious exit.

Why Tornado Still Works

Context matters here. Tornado Cash got sanctioned by the US Treasury back in 2022. Every compliance desk on earth blocked deposits tied to it. For a while it looked like the mixer was finished, boxed in by lawyers instead of code.

Then the courts got involved. A federal appeals court ruled in 2025 that Treasury overstepped its authority, and the sanctions came off. And just like that, the plumbing was legal again.

That's the thing people miss. Tornado Cash never stopped working. It went from sanctioned tool to legal tool, and addresses that were radioactive in 2023 are now just addresses. Compliance teams still flag them. Flagging isn't a wall.

So pushing $109 million through in 48 hours is brazen, but it isn't dumb. It's a calculation. Whoever's holding those keys decided the risk of sitting on the coins outweighs the risk of moving them in public.

Which raises the question nobody in the recovery business wants to answer out loud: if we can see every single deposit, why is the money still theirs?

Because chain analytics is an evidence tool, not a recovery tool. Watching isn't the same as stopping. We built a surveillance panopticon and forgot to attach any hands.

What Investigators Are Actually Saying

According to people who track this for a living, the size matters more than the method. Mixers are built for small, patient flows. You dribble in, you wait, you pull out from a clean address months later. That's the playbook.

This isn't that playbook.

$46 million in a single day is a massive deposit for a privacy tool. It's the crypto equivalent of walking into a bank branch with a duffel bag. So either the operator has withdrawals pre-staged and waiting, or they've stopped caring about being linked.

Traders are watching closely, but for a different reason than you'd expect. Most of them don't care about Drift. They care about what $138 million of hanging Ether means for supply overhang. Every dollar that eventually gets sold hits a book that's already thin on a bad week.

Here's my read, and it won't win friends: the sanctions rollback did more damage to crypto's reputation than the hacks did. We spent four years telling regulators that mixers are privacy tools, not crime tools. Then a nine-figure thief uses one as a conveyor belt and makes the other side's argument for them.

That's a brutal trade. Privacy advocates won a real legal victory and lost the narrative war inside the same twelve months.

What to Watch Next

Three things, concretely.

First, the deposit cadence. If the remaining $138 million starts moving in chunks bigger than $46 million, the operator is rushing. Rushed operators get sloppy. Sloppy is how chain analysts crack these open.

Second, exchange inflow data. Tornado withdrawals don't show up labeled as stolen funds. They show up as fresh ETH hitting deposit addresses. Watch for spikes into mid-tier exchanges over the next four to eight weeks, because that's the actual exit ramp. Mixers hide the trail. Exchanges turn it into cash.

Third, Drift itself. Whatever's left of the protocol has to be honest about whether recovery is real. Most of these situations end with a partial clawback, a settlement nobody discloses, and a long quiet silence. The odds of that $295 million coming back whole are close to zero. Anybody telling you otherwise is selling something.

Look, the market has already priced most of this in. Ether didn't crater when the deposits hit the tape. That tells you something ugly. Theft at this scale has become background noise.

And that might be the wildest part of the whole story. A nine-figure exploit used to move prices. Now it moves a headline, a few hundred quote tweets, and a two-day news cycle before everyone goes back to watching charts.

This changes things. Just not the way anyone wanted.