A wallet linked to the Drift Protocol exploit has become active again after about three months, moving 23,095 ETH, valued at roughly $44.4 million, into Tornado Cash. The transfers mark a significant shift in the handling of funds tied to the April attack, though they account for only part of the total amount stolen.

Renewed activity after months of inactivity

The wallet, labeled on Etherscan as “Drift Exploiter 4,” had shown little activity since the April exploit before resuming transfers this week. According to researcher JL, also known as 0xJaelle, the address began sending 100 ETH batches into Tornado Cash several times per minute.

Blockchain records cited in the report show the wallet processed hundreds of transactions during the move. Alongside the repeated 100 ETH deposits, the address also sent 10 ETH and 1 ETH amounts into the Tornado Cash router. In addition, four transfers totaling 0.85 ETH were sent to addresses labeled as Bybit deposits.

What the transfers indicate

The use of Tornado Cash does not by itself show that the attacker has turned the ETH into spendable cash. However, it does make the trail harder to follow by breaking the direct on-chain link between the originating wallet and later destinations.

That added layer of complexity is important in a case of this size. Drift said in an April recovery update that the stolen assets were worth $295.7 million across multiple tokens, meaning the latest movement involves only a portion of the total funds taken in the exploit.

Tracking limits and investigation efforts

On-chain investigator ZachXBT said he would not continue further tracking on his own. He cited the level of resources needed to monitor and attempt to freeze what he described as a nine-figure theft linked to North Korea.

Drift has previously said it is working with law enforcement, Mandiant and blockchain intelligence firms as part of its response. The protocol has also outlined a recovery framework that would place recovered assets into a user recovery pool.

Protocol response and recovery plans

Beyond recovery efforts, Drift has said it is pursuing stronger signing controls for critical transactions. That points to a broader effort not only to trace and recover assets where possible, but also to tighten internal safeguards after the exploit.

The latest Tornado Cash activity does not resolve the larger questions around recovery, attribution or whether additional stolen assets may move in the future. It does, however, show that a wallet tied to the attack has resumed active fund movements after a lengthy pause, adding a new phase to an already high-value investigation.

Source: crypto.news