The hacker behind the Drift Protocol exploit has begun moving stolen funds. On July 24, 2026, the hacker’s wallet deposited 23,095 ETH, worth approximately $44.4 million, into the mixing protocol Tornado Cash. This on-chain transaction marks the attacker’s first concrete step toward cashing out part of the loot, which initially totaled $285 million at the time of the exploit.
According to tracking by on-chain analytics account @lookonchain on X, the transfer of tens of thousands of ETH confirms the attacker’s strategy to launder the funds in stages. Through Tornado Cash, the origin of the coins will be mixed and severed from the original wallet, complicating further tracking efforts. This first batch of money laundering demonstrates that the hacker prefers gradually withdrawing funds rather than dumping the entire haul onto the market at once.
Most Victim Funds Remain Untouched
Although the laundering process is underway, the hacker has moved only a fraction of the total stolen assets. Tracking data shows that the exploiter’s primary wallet still holds a balance of 107,165 ETH. That $201 million in digital assets sits in the attacker’s wallet with no immediate signs of further movement.
The perpetrator’s decision to hold onto the majority of the stolen funds prolongs the tracking process. With $201 million still clearly visible on the blockchain, on-chain security trackers continue to monitor every movement from the wallet. This initial $44 million cash-out maneuver serves as a test run for the attacker to see whether the chosen exit route is safe from centralized exchange blacklists.
Laundering Funds as Lead Detective Steps Down
News of tens of thousands of ETH moving to the crypto mixer comes at a vulnerable moment for the ongoing investigation. This cash-out maneuver coincides with earlier reports that the lead detective spearheading the Drift Protocol exploit investigation has decided to step down from the post.
This oversight vacuum creates an opportunity for the attacker to launder funds more easily. Without leadership from the lead investigator, efforts to coordinate tracking coins exiting Tornado Cash could hit a dead end. The remaining $201 million in loot now waits in line to be laundered step-by-step, while the ultimate fate of victim funds grows increasingly uncertain. Reported via @lookonchain on X.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
