After the Drift Protocol attack incident, the core attacker address seemed to be "paused," with no significant fund movement recorded for an extended period. Until October 20, this address suddenly peaked in activity, marking what monitoring parties said was its first significant on-chain behavior in nearly two months: the attacker transferred at least 13,400 ETH to the Ethereum mixer protocol Tornado Cash in a single transaction. According to a single source data estimate from Onchain Lens, this amounted to approximately 32 million USD at the time's market price. Although this transfer volume was substantial, it only represented about 14% of their known ETH holdings, with around 93,965 ETH and approximately 477,375 USD in other assets still remaining in the tracked wallet. The total scale was estimated to be between 224.59 million and 225 million USD, all quantified data currently comes from the same on-chain monitoring party and has yet to undergo multi-source cross-validation. In traditional hacker narratives, large fund inflows into Tornado Cash are often viewed as the initiation of suspected money laundering pathways, increasing the difficulty of subsequent tracking. However, in the absence of more evidence, we can only interpret this action as a signal that the attacker is beginning to liquidate in batches rather than ending their holdings, with several hundred million USD in assets still unresolved, and the risk evolution will continue to linger over the entire incident in the long term.
Action After Two Months of Silence: Proportion of 13,400 ETH
According to publicly available information, monitored by Onchain Lens, the 13,400 ETH flowing into Tornado Cash on October 20 marked a significant behavior re-emerging after nearly two months of silence with no substantial on-chain actions from the attacker address. Previously, funds had been concentrated in the same wallet and remained "silent" on record; this change in rhythm from a long period of inactivity to suddenly pushing out a medium-sized amount of funds constitutes a new risk signal in itself, indicating that the attacker is starting to switch from a pure holding state to an active liquidation stage.
According to the same monitoring criteria, this wallet currently holds about 93,965 ETH, and the 13,400 ETH transferred out represents roughly 14% of the known ETH holdings, while approximately 225 million USD worth of assets remain untouched. The proportional move of "just over one-tenth" clearly does not resemble a one-off liquidation but rather seems like a test position within the overall holdings: on one hand, this amount is sufficiently large to test the intensity of current on-chain tracking, public opinion, and compliance pressure; on the other hand, it retains the vast majority of the holdings, allowing space for continued batch liquidation or acceleration of the disposal pace in the future. In the absence of more on-chain paths and law enforcement dynamics, this step appears more like the attacker’s first pressure test against the external environment rather than the final resolution of the stolen ETH holdings.
Tornado Cash Re-Designated as a Mixer Exit
The chosen exit point is also familiar. According to Onchain Lens monitoring, after reactivating, the attacker sent at least 13,400 ETH directly to Tornado Cash-related contract addresses. Under the single monitoring source data, this roughly 32 million USD worth of chip was funneled into one of Ethereum's most recognized mixer protocols. Tornado Cash has long carried a narrative of "technical neutrality" in terms of privacy: it provides on-chain anonymity for ordinary users, but has repeatedly been used by hackers in past attack events as an exit for handling involved or sensitive assets, keeping it constantly under regulatory and compliance scrutiny, with this incident being the latest case pulling it back into the spotlight.
From an on-chain tracking perspective, once funds enter mixing services, path analysis enters a more complex mode. Mixing disrupts the sources of funds within a common pool and alters the output rhythm, significantly weakening external certainty about a single address or path. The upstream "whose money is this" becomes a downstream probability question of "who does this money belong to." For the attacker, this could be a move to test the actual protective effect of privacy tools, but under the premise that motivations can only be described as "suspected" or "possible," the clearer conclusion is: the tug-of-war between privacy rights and compliance requirements has been thrust back into the limelight, and the lines that on-chain analysis can reach have been redrawn into a blur by the flow of 13,400 ETH.
Wallet Still Holds Approximately 225 Million USD with Unknown Direction
According to Onchain Lens monitoring, while transferring 13,400 ETH into Tornado Cash, the tracked wallet still retains approximately 93,965 ETH and about 477,375 USD worth of assets, with an estimated total scale between 224.59 million and 225 million USD based on single-source estimates. In other words, this action merely pushed around 14% of the ETH position into the mixing process, while the vast majority of ETH and the total block of USD-valued assets have not shown any indications of similar-sized on-chain migration, resulting in a state of "partial awakening, principal sleeping" in the account.
From the commonality of past hacker cases, batch and multi-path asset disposal is a common strategy to reduce the risk of single-exposure and prolong the disposal cycle. This instance, involving only a small amount of ETH, appears more like the beginning of this pattern rather than the endpoint. The remaining assets, valued at around 225 million USD, may potentially be split into smaller fragments and gradually dissipated along different protocols and paths, or may continue to remain inactive for some time, awaiting a shift in regulatory and public attention. For Drift users and the broader market participants, the real uncertainty lies not with the 13,400 ETH that has already entered the mixing pool, but with the large block of remaining assets yet to choose a direction, indicating that the event risk has not been sealed but merely delayed and repackaged into a longer-term unresolved suspense.
On-chain Cat and Mouse Game Between Trackers and Attackers
The transfer of 13,400 ETH on October 20 was not a quiet "technical operation," but was immediately captured on the public chain. According to public information, this unusually large transfer was first marked and disclosed by Onchain Lens, subsequently being reported by multiple crypto media outlets, causing this record, buried in the block data, to quickly become a new focal point of public discourse. After nearly two months of silence, the attacker address suddenly initiated a disposal action, prompting a nearly synchronous response from monitoring parties and narrative creators. This real-time observation itself created a new pressure field—the attacker’s every click on "send" is a game against public chain data and opinion surveillance aimed at shedding light.
Once funds enter Tornado Cash, the story moves into a more concealed chapter. According to the basic operational mode of this mixer protocol, deposited ETH is often split into smaller fragments and mixed with assets from other depositors, then slowly flows out from different exit addresses. This technically significantly raises the barriers to post-incident tracing. However, there is no true "disappearance" on-chain: the starting address has been widely labeled, and the time, batches, and amounts entering the mixing pool are still recorded; it just requires longer time and more complex models to reassemble credible paths within the fragmented outflow mode. It is also crucial to emphasize that all current quantitative data and path determinations surrounding this batch of funds originate from a single monitoring perspective of Onchain Lens and have not received independent on-chain verification or multi-source cross-confirmation. Speculations regarding "money laundering intentions" and "risk spillovers" must be treated at a cautious hypothesis level rather than being written into a confirmed causal chain of events.
What to Watch Next Is Not the Next Transaction But the Rhythm
The 13,400 ETH sent to Tornado Cash signals that the money laundering path has officially been opened rather than nearing its end. According to Onchain Lens data, the attacker’s wallet still holds approximately 225 million USD worth of assets, indicating that new on-chain disposals may emerge at any time afterward, and the risk evolution appears to be a lengthy process. What we should be watching next includes not just "whether there will be a next transaction," but whether the rhythm accelerates, whether batch transfers become normalized, whether complex paths such as cross-chain operations or attempts to cash out appear, while also paying attention to whether project parties or law enforcement provide more detailed public responses afterward. With the current publicly available information, the identity of the attacker and the judicial jurisdiction have not been disclosed, and the quantitative data surrounding this batch of funds comes only from a single monitoring perspective. Thus, the market's interpretation of this on-chain action should more reasonably treat it as a point where the risk curve has been reactivated rather than simply assuming the risk has been digested or a new trend has been established.
Join our community to discuss and grow stronger together!
AiCoin Exclusive Hyperliquid Benefit: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin Exclusive Aster Benefit: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram Community: https://t.me/AiCoinWhaleData
On-chain Community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
