Funds linked to an earlier Drift Protocol case resume movement into Tornado Cash

Incident overview

This record concerns renewed movement of funds linked by a monitoring account to an April Drift Protocol case; it is not a new attack on Drift. After roughly three months of inactivity, the reported funds began moving into Tornado Cash in repeated 100 ETH batches.

Incident sequence

1. Funds linked to the older case had reportedly remained inactive for roughly three months.
2. A monitoring account observed ETH being split into 100 ETH batches.
3. Multiple Tornado Cash Router deposits were made per minute.
4. The public post linked to an Arkham entity page but did not disclose the complete source address, transaction list, or a reconciled total in the post itself.

Fund flow

Solana old-case assets / previously used cross-chain route → Ethereum-linked funds → 100 ETH batches → Tornado Cash Router. The historical bridge path from Solana to Ethereum was not fully reconciled in this review.

Amount basis

The post cited an approximately $285 million nominal figure for the older case. That figure is not a loss incurred on July 23 and is not added to the day’s new-attack total. A complete transaction-by-transaction total for this movement was not independently reconciled.

Evidence boundary

This record relies on one public monitoring post and a linked but truncated Arkham entity reference. Without complete addresses and transaction IDs, the record remains an old-case movement lead and no address is added to the formal label ledger.

Current status

Renewed old-case movement and mixer use were reported. No freeze, return, or law-enforcement action was confirmed.