An address tied to the Drift Protocol hacker has started moving Ether again after a three-month pause, according to onchain data cited by BlockBeats and Onchain Lens.
The wallet sent 100 ETH at a time into Tornado Cash, the crypto mixing service that obscures the trail between deposits and withdrawals. Those transfers were repeated several times a minute, marking the first known activity from the address in roughly three months.
Drift was hit by a $285.3 million hack in April, one of the biggest crypto thefts of the first half of the year. The new transfers do not change that earlier loss, but they do show the attacker is still moving funds on-chain and still using a tool designed to make transaction tracing harder.
Tornado Cash has long been used for that purpose. By pooling deposits and withdrawals, it makes it more difficult to link coins to a specific sender or recipient, which is why it remains closely watched by investigators, exchanges and compliance teams.
The latest activity matters for Ether as well, since the transfers were made in ETH rather than another token. Large, repeated movements into a mixer can draw attention on trading desks because they may coincide with attempts to split, hide or reposition stolen assets.
There is no indication from the source that the attacker recovered any additional funds or that Drift’s losses have changed. The immediate watch item is whether the address continues sending ETH, and whether the pattern expands beyond the 100-coin transfers seen on July 23.
Drift hacker resumes sending Ether to Tornado Cash, making funds harder to trace
A hacker linked to the Drift Protocol has resumed activity by transferring stolen Ether to Tornado Cash, a crypto mixing service. This follows a $285.3 million hack of Drift, making it a significant ongoing security threat.