Drift's Exploiter Moved $61M Through Tornado Cash and Still Holds $194M

The Drift exploiter isn't hiding. That's the part everyone keeps skipping past.

We regret to inform you that $61 million in ETH just walked through Tornado Cash, out of a hack that drained roughly $295 million on April 1. And the wallet still holds about $194 million, sitting there like a middle finger with a balance.

That's not a fleeing criminal. That's a landlord collecting rent.

The Receipts

Start with the size, because the size is the point. $295 million puts this among the biggest DeFi breaches of the year. Mandiant traced it to a North Korean threat group, which means this wasn't three guys in a Discord call. It was a state operation with payroll, quotas, and a laundering playbook they've run enough times to have muscle memory.

Then there's the mixer. Tornado Cash spent years as the boogeyman of crypto compliance. OFAC sanctioned it in August 2022. A federal appeals court vacated that in November 2024. The Treasury pulled the sanctions in March 2025. And now a North Korean-linked crew is routing nine figures through it like the whole episode never happened.

The timeline is undefeated.

Here's what bothers me. If the sanctions were working, you'd expect a hacker to move slow. Split the funds. Wait a year. Instead we get $61 million moving while the wallet still holds $194 million. That's not caution. That's someone who ran the numbers and figured the risk was acceptable.

So what exactly did two and a half years of sanctions accomplish? A court case and a press cycle?

And notice what didn't happen. No funds frozen. No arrest. No dramatic seizure announcement. Just a quiet transfer, a blockchain explorer page, and a bunch of people on CT posting the transaction hash like it's a sports score.

The hack happened five months ago. Five months is an eternity in crypto. Meme coins have launched, pumped, rugged, and died in that window. Drift's attackers are still holding most of the bag.

Okay, But Maybe It's Stuck

Let me steelman the optimist case, because there's one.

Laundering $295 million is genuinely hard. Tornado Cash gives you privacy at the deposit layer, but the exit is where people get caught. Exchanges have chain analysis. Circle can freeze USDC. Bridges are watched. The $194 million could be functionally trapped, a number on a screen that can never become a house in Pyongyang.

That's the argument. And it's not stupid.

There's also a real point about DeFi maturity. Drift survived. Users got some resolution. The investigation got done fast, by Mandiant, with attribution. A few years ago, a $295 million exploit would've been the last anyone heard of the protocol. Now there's a paper trail, a named threat actor, and a functioning post-mortem. That's progress, even if it doesn't feel like it.

But here's where the counterpoint falls apart. If the money were truly stuck, why move $61 million of it? Hackers don't burn fees on a mixer run for fun. Moving funds means they believe the exit exists, or they're willing to pay to find out. Either way, the deterrent isn't deterring.

And the deeper problem is patience. North Korean crews don't have a quarterly earnings call. They can wait three years. They can wait until the news cycle dies, the exchange compliance teams rotate, and the case file goes cold. What's the counter-strategy for a thief with a state budget and no deadline?

CT never misses. Except when it does. The timeline moved on from Drift in about a week.

The Verdict

The $194 million is the story. Not the hack, not the mixer, not the attribution.

Because that number tells you what stolen crypto is now. It's not a smash and grab anymore. It's inventory. Hackers take the bag and sit on it, and the industry has basically accepted that a nine-figure theft can resolve into a permanent holding pattern where the attacker keeps custody and everyone else keeps posting about it.

Ask yourself who actually lost here. Drift's users lost. The protocol's reputation took the hit. Tornado Cash got a fresh PR problem it didn't need right after winning its sanctions fight. And the attackers? They got $194 million and a five-month head start.

That's the worst part. The cost of doing this business keeps going down.

Look, I'm not saying crypto is uniquely broken. Traditional finance has its own laundry, just with better suits and slower courts. But DeFi keeps advertising transparency as a feature, and transparency is only useful if someone acts on what they see. Right now we can watch every dollar move and do almost nothing about it.

So here's my take, and I'll say it plainly. Until a $295 million exploit ends with a frozen wallet instead of a transaction hash on a block explorer, the deterrent is theater. Another day, another saga. This one just happens to still be open.