The turmoil surrounding the attack on Drift Protocol has not come to an end with the exposure of the incident. Earlier, this attack siphoned more than $270 million in assets from the protocol. According to on-chain analysis account Lookonchain, the stolen funds are still slowly circulating on-chain. The attacker has not chosen to "clear out" all at once but has deliberately disposed of the funds by entering them in batches: recently, their associated address deposited 24,885 ETH into Tornado Cash, worth approximately $61.3 million, and after completing this operation, the address still holds about 56,569 ETH, valued at approximately $139.3 million at the time of reporting. Several media outlets have quoted relevant data, exposing this financial path to a larger public view, but the current publicly available information does not indicate that these stolen funds have been fully disposed of or recovered, and the large amount of ETH continues to remain under the control of the attacker, meaning the on-chain game surrounding the Drift attack case is still ongoing, with the fate of the stolen funds far from settled.
The Massive Stolen Funds in the Aftermath of the Drift Attack
Returning to the source of the incident, after the attack on Drift Protocol, the scale of stolen assets was directly raised to over $270 million. According to Lookonchain, this is a significant blow that could rank among the top safety incidents of the year. More critically, this is not a sum that quickly "vanished" after the incident, but rather a massive black box that continues to exist in the form of on-chain addresses, with the core asset form clearly visible — the subject of the stolen funds mentioned in current public reports is ETH, which is continually controlled by the attacker, moving and disposing of funds in batches.
From the balance after the latest operation, the amount of ETH on this address remains hard to ignore. After depositing some funds in batches into Tornado Cash, on-chain records show that this address still holds about 56,569 ETH, worth approximately $139.3 million at the time of reporting, which indicates that the attacker currently maintains a "protocol-level" massive ETH position, and the disposal of the stolen funds is far from reaching an endpoint. In other words, this security incident of Drift has not ended with the attack but has extended into a long-term on-chain game revolving around the fate of the massive ETH stolen funds, with each new financial path choice writing the next chapter of this prolonged battle.
Batch Deposits into Tornado Cash
Surrounding this still present massive ETH, the attacker’s latest action was to deposit 24,885 ETH into Tornado Cash; according to Lookonchain, this was worth approximately $61.3 million at the time of reporting. This was not a "clear-out" action but rather a continuation of previous habitual practices — only handling a portion of the chips, splitting the large stolen funds into manageable injections. Rather than simply a transfer, this can be seen as the attacker actively controlling the rhythm in this long-term game: allowing some assets to enter the mixing pool to attempt to obscure their source while deliberately retaining a large portion on the original address for greater flexibility in subsequent actions.
From an on-chain perspective, this batch entry strategy directly rewrites the visibility and tracking timeline. If the attacker had pushed all the ETH into Tornado Cash at once, on-chain monitoring would face an unprecedented, highly concentrated single event; however, under the current model, the market sees a series of split nodes, with each injection being relatively "manageable," yet stretched into an ever-extending trajectory over time. For observers trying to reconstruct the destination of the stolen funds, each batch deposit becomes a new window for evidence collection, also a new source of noise, and the attacker is amplifying the complexity of the on-chain narrative while continuously elongating the tracking line of the entire event through this rhythmic processing method.
The Game with 56,569 ETH Still Held
However, no matter how many nodes the stolen funds are split into, the most striking number on-chain has not changed — according to Lookonchain, after the latest deposit of 24,885 ETH into Tornado Cash, about 56,569 ETH remains on the attacker’s address, corresponding to around $139.3 million at the time. This balance is far greater than any single injection amount, indicating that the batch disposal is merely a slow digestion of "scraps," with the true main chips always hanging above the publicly accessible on-chain ledger.
In this structure, a peculiar game has formed between the attacker and the trackers: on one hand, the public holdings allow everyone to see the existence of these 56,569 ETH in real-time, making it almost impossible for the associated addresses to "disappear" out of thin air; on the other hand, the attacker is employing ongoing small-scale mixing operations to attempt to increase the difficulty of evidence collection with each move of funds, shifting pressure from "immediate liquidation" to "long-term consumption." For the protocol, regulators, and on-chain analysts, this massive balance itself is still a visible target, which means the time window for tracking and potential action has not yet closed, also clearly indicating that this tug-of-war around the destination of the stolen funds is far from over.
On-Chain Monitoring and Multi-Platform Alerts
The reason this tug-of-war has been able to maintain a "visible state" is that nearly every move the attacker makes is closely monitored by on-chain analysis accounts. According to Lookonchain, this latest action of depositing 24,885 ETH into Tornado Cash was captured and published during a continuous tracking process of interactions between the attacker’s address and the mixing contract, while pointing out there is still about 56,569 ETH remaining on the address. For the outside world, such disclosures not only provide precise timestamps, amounts, and entry points but also visually present the remaining chip volume of the attacker, making "how much unused stolen money is still left" no longer an abstract guess but a clear figure that can be referenced and discussed.
On the information dissemination front, multiple media outlets have echoed the same on-chain cues, forming a reminder effect that overflows from the professional analysis circle to broader readers. As Deep Tide TechFlow, PANews, and Odaily Planet Daily subsequently reported Lookonchain’s monitoring results, they amplified the two core pieces of information: "latest injection amount" and "current ETH balance of the address," making the dynamics of these stolen funds not just exist in the notes of a few on-chain researchers but make their way into a larger public discourse. The value of public monitoring lies in that every new movement of funds is difficult to completely conceal, and the protocol, users, and potential regulatory bodies can receive signals in nearly synchronized time dimensions; but its limitations are equally clear — on-chain revelations show "visibility," not "disposal," and with mixing tools still open, what monitoring can offer more is a continuous tracking and pressure of public opinion, rather than a final judgment on the direction of funds.
Follow-Up Observations on the Stolen Funds from Drift
Based on the current publicly available on-chain information, this attack incident, which exceeded $270 million, has not concluded after the "first escape," but rather has entered a phase of batch disposal and long-term attempts to fade from sight. According to data released by Lookonchain, the attacker has repeatedly injected stolen funds into Tornado Cash, recently depositing 24,885 ETH in a single action, worth approximately $61.3 million, but following this transaction, their associated address still holds around 56,569 ETH, approximately $139.3 million in massive balance, with mixing and substantial holding existing concurrently. Key on-chain signals to observe going forward include: whether similar rhythms continue for batch transfers to Tornado Cash, whether new receiving addresses or funding paths appear, and whether this portion of ETH still exposed on-chain is further split or left stagnant for long periods. It should be emphasized that there is currently no verified public information indicating that the stolen funds have been completely disposed of or recovered; such large-scale security events often evolve into on-chain games lasting for months or even longer, with the day of the attack merely being the story's beginning, and the real tracking and dismantling work will continue along with each new financial movement.
Join our community to discuss together and become stronger!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
