A wallet tied to the Drift Protocol exploit has moved roughly $61 million in ETH into Tornado Cash after a two-month dormancy, while on-chain telemetry shows the exploiter cluster still holds about $195 million in cold storage — a slow-burn laundering pattern that is resetting expectations for how long stolen DeFi funds can sit before they move.
The timing is the detail that matters most. After the $285 million Drift exploit, the attacker addresses executed no outbound calls for approximately 60 days. Then, on October 20, they initiated a compressed laundering window, funneling 25,700 ETH — around $61.56 million — through the Tornado Cash 100-ETH pool in 257 sequential deposits of exactly 100 ETH each, a batch size chosen to disperse the transaction graph across the anonymity set. On-chain telemetry from lookonchain and Arkham confirms that despite the cash-out, the cluster retains 81,800 ETH in untouched cold storage. The dormant-then-burst pattern has become the template for post-exploit laundering in DeFi: a long silence that outlasts the first wave of on-chain triage alerts and exchange-compliance monitoring, followed by a fast, batched exodus.
The operational consequence for the DeFi security community is that a "recovery token" model, which worked for smaller exploits where funds were identifiable on-chain, is less effective when the attacker deliberately staggers the withdrawal and parks the bulk in addresses that show no inbound or outbound activity for months. Defenders have to watch the cold-storage clusters for months, not hours, and build their attribution tooling to handle dormant actors. The 81,800 ETH figure — roughly $195 million — is not yet laundered; it is a pending event. The window in which the attacker's position is still traceable to a single exploit is closing, and every week of dormancy makes the chain between the stolen funds and the final destination one link longer.
Read alongside the Coinbase and The Block study that stablecoins move more than $400 million per hour on average — with off-hours transfers dominating — the Drift recovery is a reminder that DeFi's settlement plumbing runs on a different clock than TradFi's. The money does not sit still; it goes quiet, moves, and reappears as someone else's liquidity. For the market, the immediate question is not whether the remaining $195 million will ever be recovered, but how the next two months of on-chain silence will be priced into DeFi's risk premium, and whether the slow-burn laundering pattern pushes exchange and chain teams to extend their monitoring windows from days to quarters.
Image source: i.ibb.co