On October 20, the Drift exploiter’s identified wallets routed 25,700 ETH into Tornado Cash, while estimates of the ETH still held diverge: Lookonchain reported 81,864 ETH (about $195M), and The Defiant cited about 84,164 ETH across five Etherscan-labeled wallets. The exact remaining total is not established by the available wallet-level reads. Lookonchain · The Defiant

Tornado Cash$DRIFTOct 20, 2026, 20:09 UTC

The identified deposit wallet, 0xaa84…57c1, reportedly made 257 deposits of 100 ETH each and held about 3.98 ETH afterward; that is the balance of this wallet, not the exploiter’s total. 0xkuncoro’s on-chain account

Drift Foundation’s September 30 update said three of four tracked Ethereum wallets held 107,165 ETH at that time, and about $9.2M had been frozen. It said tracking continued with zeroShadow and law enforcement, with recovered funds directed to the DFX recovery pool. Drift Foundation

On October 5, the Foundation said the recovery pool covered around 1% of verified claims; Tether’s commitment of up to 127.5M USDT was matched against Velocity net protocol revenue, not already received as a lump sum. Claims opened October 1 and close at 00:00 UTC on January 1, 2028. Recovery and DFX details · Claim announcement

The mixer deposits obscure direct deposit-to-withdrawal links, so the cited records establish laundering into Tornado Cash, not how much of those deposits has since been withdrawn or recovered. The Defiant

Ask your own

Case file

Tornado Cash

$DRIFTsolana, DriFtu…jwg7

Answered Oct 20, 2026, 20:09 UTC

Sources 7

Research trace 12

The linked original X post
Latest posts of @lookonchain
Latest posts of @CoinMarketCap
Latest posts of @DriftProtocol
The page arkm.com
The page t.me
This step's reads serve identifying the exploiter's wallets and verifying current ETH holdings; the previous results showed the Lookonchain post and a Drops Bot deep link naming one wallet, so we are reading that wallet's owner, balances and transfers and searching for the other hacker wallets.
Arkham's balance read gave 56,568 ETH on the wallet 0x0fe3…b674 and its 24h-ago value implies that wallet did not send ETH out today, so the 25,700 ETH deposited to Tornado Cash came from other exploiter wallets. This step reads that wallet's transaction history and exact native balance, its counterparties (to get the Tornado Cash contract address), the full text of the salus_sec, EyeOnChain and The_NewsCrypto posts (which name the other wallet addresses), the news wire for the latest on the stolen funds and the Telegram channels for wallet tracking, plus the current Ethereum head so a later log window can be set.
This step finds the other exploiter wallets (the 24.9K ETH one and the 0xaa843e wallet) and the exact block window for Oct 20, 2026 so the Tornado Cash deposits can be read on-chain. The previous results gave one wallet (0x0fe3…b674) at 56,568 ETH and salus_sec naming a second wallet 0xaa843e…57c1 at 6,114 ETH, while Lookonchain claims 81,864 ETH total, so the remaining wallet is the gap.
I’m resolving the incomplete wallet reference and looking for direct transaction or wallet evidence behind the varying ETH totals. In parallel, I’m checking Drift’s September recovery update and October claim programme for the current status of recovery.
The prior results identify two Ethereum wallets and give conflicting remaining-balance figures: Lookonchain reports 81,864 ETH, while Drift’s September 30 update says 107,165 ETH remained after the July deposit. These reads check the named wallet’s current balance and transfers, seek on-chain addresses behind the October deposits, and look for any newer Drift recovery status.
The earlier results confirm two wallets but leave a gap between Lookonchain’s 81,864 ETH and Drift’s September 30 figure of 107,165 ETH. These reads seek the exact October mixer activity, the remaining wallet identities or updated totals, and Drift’s stated recovery status.