Tornado Cash processed 968 deposits on July 23, its busiest day of 2026, according to L2Beat data.
The spike shows large-scale attackers have returned to the privacy protocol since the U.S. Treasury lifted sanctions in March 2025 — and that its baseline usage keeps climbing even as developer Roman Storm awaits a retrial over operating it.
Depositors moved 29,573 ETH, worth about $57.2 million at July 23 prices, into the mixer's Ethereum pools that day across 110 addresses, per onchain data. Most of it came from one: the address labeled Drift Exploiter 4 made 245 deposits totaling 23,095 ETH, about $44.4 million and 78% of the day's inflow, in under two hours.
"The Drift Protocol exploiter who stole $285M has deposited 23,095 $ETH ($44.4M) into #TornadoCash today," onchain tracker Lookonchain wrote on X on July 24. "The exploiter still holds 107,165 $ETH ($201M)."
Security firm PeckShield posted the same figures, noting the exploiter also sent 0.85 ETH to Bybit.











