The Drift attacker has transferred 25,700 ETH to Tornado Cash and still holds approximately $195 million worth of ETH.
Addresses linked to the Drift attacker have transferred 25,700 ETH to Tornado Cash. After completing the transfer, the attacker still holds approximately $195 million worth of ETH. The same fund movement involved more than $60 million worth of ETH flowing into the mixer, and the incident has been classified as a large movement of stolen funds, drawing increased attention from security and on-chain fund tracking. The confirmed progress at present is that a large amount of ETH has entered Tornado Cash, while the remaining holdings are still in addresses linked to the attacker. The incident has expanded from a single issue of stolen-fund holdings to one of fund flows and tracking.
Based on confirmed data, 25,700 ETH is the most direct transfer quantity disclosed in this round, more than $60 million worth of ETH flowing into the mixer is a dollar-value measure, and approximately $195 million worth of ETH constitutes the scale of remaining holdings. The three figures appear side by side, indicating that not all of the ETH involved has entered the mixer and that a large amount of ETH remains to be observed in the attacker's addresses or related holdings. Tornado Cash is identified in the disclosure as a mixer, while the Drift attacker is the actor behind this fund movement. The portion transferred into the mixer and the portion still held by the attacker represent different bases. The existing disclosure does not further explain the conversion relationship between the transfer quantity and the dollar-value measure, so they are presented side by side without undisclosed corresponding calculations. The disclosure also notes that similar duplicate reports have been merged. Currently available information mainly centers on the fund transfer and the remaining holdings.
From the structure of the disclosure, the information does not provide fund scale on a single dimension but instead gives both ETH quantity and dollar amount. This side-by-side disclosure allows readers to observe the fund movement from the perspectives of crypto asset quantity and dollar value, but it also means that 25,700 ETH cannot simply be equated with part of the more than $60 million or the $195 million. Because the existing disclosure does not give the ETH quantity corresponding to the remaining holdings, outsiders can only confirm two independent pieces of information: first, the quantity of ETH transferred into the mixer; second, the dollar-value scale still held by the attacker. This disclosure method preserves the independence of key data and also limits the scope for further calculation.
In terms of fund flow, after large amounts of ETH enter Tornado Cash, market attention usually focuses on where the funds go, address links and tracking difficulty. However, publicly available information currently only confirms the transfer quantity and the amount involved; transaction batches, number of addresses, specific timeline and follow-up handling details have not been disclosed. The scope of analysis of the mixer stage is limited to the disclosed fund movement. Information such as the attack method, the specific composition of losses involved and progress in fund disposition has not appeared in confirmable form, so no supplement is made. The core of the current information is the distinction between confirmed on-chain fund movement and investigation or disposition progress that has not yet been disclosed. For readers, the core facts that can currently be tracked remain the fund transfer and remaining holdings, rather than unpublicized investigation conclusions.
After transferring 25,700 ETH, the attacker still holds approximately $195 million worth of ETH. This remaining scale means that subsequent on-chain fund changes still have observation value. There is currently no information showing whether the remaining ETH will continue to be transferred, enter other mixers, or be tracked or frozen. This large movement of stolen funds involves more than $60 million worth of ETH flowing into a mixer, and security and fund-tracking attention is high. The core elements of the incident include the Drift attacker, Tornado Cash, the transfer quantity, the dollar-value measure and the approximately $195 million in remaining ETH; together they form the factual framework. In terms of the nature of the incident, it is a security and on-chain fund-tracking event; in the absence of more public information, its impact remains mainly at the factual level of fund flows and does not extend to judgment about price direction. For on-chain fund tracking, transfer into a mixer and remaining holdings are two different observation dimensions: the former points to the concealment and flow path of funds, while the latter points to the scale of assets the attacker has not yet disposed of. The coexistence of the two means the incident has not ended with a single transfer.
At the industry level, this fund movement provides a sample for observing the flow of large stolen funds. The scope of security and fund-tracking attention already covers inflows into mixers, the scale of remaining holdings and subsequent tracking progress. The scope of incident reporting is concentrated on the Drift attacker's fund movement itself and does not involve other unrelated events. Going forward, attention can be paid to on-chain address changes after the Tornado Cash-related inflows, movements of the attacker's remaining holdings, and whether new fund-tracking or security disclosures emerge. Based on current information, the incident remains at the stage where the fund movement has been recorded and observed, and follow-up indicators remain the confirmed transfer quantity, the dollar-value measure and changes in remaining holdings.
