Wallets linked by blockchain analysts to the Drift Protocol exploit moved 25,700 ETH into Tornado Cash on October 20, according to Lookonchain, bringing renewed activity to funds associated with one of this year’s largest DeFi thefts.
The monitoring account reported the deposits over a two-hour period after roughly two months of inactivity. The new transfers concern assets traced to the earlier attack, rather than a newly reported breach of Drift.
BitcoinInsider has not independently verified the transaction hashes or the attribution of the wallets. The amount and connection to the exploiter are Lookonchain’s findings; a transaction on Ethereum does not, by itself, identify the person controlling an address.
The original loss began with privileged access
Drift, a trading protocol on Solana, was attacked on April 1. Chainalysis estimated the loss at $285 million and described an operation that obtained administrative control before using artificially valued collateral to withdraw real assets.
Its April account connected the incident to a prolonged effort to compromise trusted contributors, citing Drift’s investigation. That is a different failure mechanism from a trader losing money through an ordinary market move: control over sensitive actions allowed the attacker to change what the system would accept.
The assets’ later appearance on Ethereum does not make this an Ethereum protocol exploit. Funds can be exchanged and moved across networks after an attack, leaving investigators to connect multiple stages rather than follow one unchanged token on one chain.
Movement is different from recovery
Tornado Cash is a privacy tool intended to weaken the readily visible connection between a deposit and a later withdrawal. A deposit can therefore complicate public tracing, but it is not evidence that the money has reached a final owner or become impossible for investigators to follow.
Nor does a visible transfer return assets to users. Recovery requires control of funds to pass back to the protocol, a recovery vehicle or affected holders. Watching a wallet move is information about the route, rather than an announcement that losses have been repaired.
Drift’s April recovery framework described a dedicated pool and a separate recovery token, with recovered assets intended to support that pool. Tether separately announced proposed financial support. Proposed contributions, credit facilities and future revenue must be distinguished from cash already distributed to victims.
Users remain dependent on verified recovery information
The latest report puts the stolen-asset trail back in focus without changing the underlying distinction between token ownership and protocol exposure. A user can retain control of a personal wallet while suffering a loss on assets previously deposited into an application.
Our guide to self-custody wallets and recovery explains those control boundaries. Keeping a private key safe does not undo a compromise of the separate system to which assets have been entrusted.
For affected Drift users, the substantive follow-up is whether investigators recover assets and whether the recovery pool receives them. Lookonchain’s reported deposits show renewed fund movement; they do not establish either outcome.