Solana OG Attacker Just Sent Another $4.39M to Tornado Cash-Why This Changes Nothing

Drift exploiter wallet deposits $44.4M into Tornado Cash after a long pause

This looks like a laundering step, not a fresh exploit. After roughly three months of inactivity, the wallet tied to the $285 million Drift Protocol exploit sent 23,095.1 ETH, worth about $44.4 million, into Tornado Cash.

The main implication is straightforward: recovery may become harder, but user funds were not drained again.

Why the timing matters

The major drain already happened. This newer transfer is part of the post-attack money trail, not a new hit to Drift users.

Tornado Cash pools deposits and allows later withdrawals from different addresses. That does not erase the funds, but it can weaken direct links between sender and receiver and make reversal more difficult. The resumed activity also suggests the attacker may be preparing the funds for exchange entry or further layering.

One brief context note: the original drain was carried out through pre-signed transactions that remained valid for more than a week using durable nonces.

The Drift breach was mainly a workflow and social-engineering failure

Drift was not broken by an obvious smart-contract bug. It was broken through people, process, and a legitimate Solana feature.

How the attacker gained control

The attack sequence was simple in retrospect:

• The exploit chain was not a hack in the traditional sense.
• There was no manipulated oracle or flash-loan logic error at the center of it.
• Instead, the attacker combined social engineering, durable-nonce pre-signing, and fast batched withdrawals.

Why this matters beyond Drift

The initial breach gave the attacker control. The Tornado Cash deposit suggests monetization is still underway.

That context matters because North Korean-linked groups stole roughly USD 577 million in 2026 YTD across just a handful of attributed incidents. Drift was not an isolated blip; it fits a broader pattern of large, coordinated thefts.

For Solana DeFi builders and users, the high-value target is not just the contract surface. It is also multisig and admin workflows that rely on delayed or pre-signed transactions. Once signers approve a durable-nonce transaction, the usual safety net around stale blockhashes is effectively removed.

What to watch

• Pre-signed admin transactions: any protocol using durable nonces for council or treasury actions needs stronger verification discipline.
• Multisig hygiene: social engineering remains the first unlock, and signers are still the weakest link.
• Mixer proximity: once stolen funds reach Tornado Cash, the window for clean reversal usually narrows.

What the latest Tornado transfer means for recovery odds

New mixer hop, same question: does this improve the chances of recovering funds, or push them closer to irreversibility?

The balance of evidence points to the latter, with one narrow exception. After roughly three months of inactivity, the exploiter wallet sent 23,095.1 ETH into Tornado Cash and also moved 0.85 ETH to wallets labeled as Bybit deposit addresses. That looks less like a fresh exploit and more like a monetization decision.

The small upside and the bigger risk

The bigger risk is that Tornado Cash weakens the direct public link between sender and receiver. For a likely DPRK-linked operator, that is a routine step. These groups typically have mature laundering playbooks, and DPRK-linked groups accounted for the vast majority of crypto hack losses attributed in TRM's 2026 data through April.

What would change the read

• Recovery odds improve if exchange-facing transfers broaden or cluster, giving responders more addresses and timing data to act on.
• Recovery odds weaken further if the large Tornado Cash deposit produces no visible exchange proximity and the funds keep moving through standard laundering paths.
• The situation changes materially only if there is a visible freeze or recovery win tied to these new destinations; absent that, this looks like another step toward irreversibility.