Wallets attributed by Arkham to the April Drift Protocol exploiter deposited $122.3 million in ether into Tornado Cash on October 20 and October 21. The Arkham reconstruction identifies 520 deposits over roughly 25 hours.
The pattern was mechanical: 505 transfers of 100 ETH, nine transfers of 10 ETH, five transfers of 1 ETH and one transfer of 0.1 ETH. Arkham calculated $61.39 million of deposits on October 20 and $60.92 million on October 21. The deposits are onchain events. The exploiter attribution depends on Arkham’s clustering and tracing from the April incident.
Arkham links the funds to Drift’s April 1 loss, when a malicious administrative transfer removed assets from the Solana protocol before funds were bridged to Ethereum. The analytics firm reported that the wallets had remained dormant for six months before the mixer deposits.
The attributed entity still holds approximately 56,568 ETH plus about $549,000 in USDY, worth roughly $137.2 million at the time of Arkham’s report. That balance creates continuing movement risk, but it does not prove that the remaining funds will enter a mixer or exchange.
Tornado Cash deposits sever the simple public link between a deposit address and later withdrawals. They do not prove cash conversion, identify an off-ramp or establish that every eventual withdrawal belongs to the original depositor.
TOKEN RECON ASSESSMENT
The material update is the first movement in six months and the scale of the mixer deposits. Recovery prospects have deteriorated because the funds are now harder to follow, but they are not automatically unrecoverable. Investigators should focus on deposit transaction hashes, timing clusters, any later address reuse and regulated off-ramps. The remaining 56,568 ETH is the next high-value confirmation trigger.
