Drift Exploiter Deposits Another Batch of Stolen Funds

The wallet linked to the Drift protocol exploit has deposited another batch of stolen funds, security monitoring firm PeckShield reported, marking a continued effort to move assets tied to the incident. The latest movement signals that on-chain tracing of the exploiter’s holdings remains an active concern for the DeFi ecosystem.

Blockchain security firm PeckShield flagged the activity in a post on X, alerting its followers that the Drift exploiter had made an additional deposit. The alert adds to a documented pattern of incremental fund movements from the address, as the exploiter continues to redistribute or obscure stolen assets across wallets. For related coverage, see Chainalysis Says Drift Exploiter Moved Funds to Stopover Wallet.

PeckShieldAlert: #Drift Exploiter has deposited another batch of stolen funds pic.twitter.com/placeholder For related coverage, see Drift Protocol Exploiter Buys 1,195 ETH, Wallet Tops 130,262 ETH.

— PeckShieldAlert (@PeckShieldAlert) October 2026

Source: @PeckShieldAlert on X

Another deposit in a pattern of incremental fund movement

The phrase “another batch” in PeckShield’s alert is significant: it confirms this is not the first reported movement of stolen funds from the address. Earlier tracking showed the exploiter had already moved 23,095 ETH into Tornado Cash, using the privacy protocol as a standard obfuscation layer for large illicit transfers. The latest deposit follows that established operational pattern.

Chainalysis previously identified a stopover wallet in the fund flow, consistent with multi-hop routing strategies used to complicate on-chain attribution. The address associated with the Drift exploiter can be queried directly on Etherscan, where transaction history reflects the series of outbound movements that security researchers have been monitoring since the original incident.

Prior to this latest deposit, the exploiter’s wallet had accumulated over 130,262 ETH after purchasing an additional 1,195 ETH on the open market, an unusual move that suggested the address remained operationally active rather than dormant.

What continued movement means for tracing efforts

Each additional deposit complicates attribution but also generates new on-chain evidence. Every transaction from the exploiter’s known address extends the traceable graph that blockchain analytics firms use to map fund flow across wallets, exchanges, and mixing services. A fresh deposit is both a risk event and a data point.

The operative question for investigators is whether the destination of this latest batch is a known exchange deposit address, a fresh intermediary wallet, or a privacy protocol. None of those details have been confirmed in the current reporting. Until destination and amount are independently verified against on-chain records, the scope of this specific movement remains unquantified.

The Drift exploiter’s resumed activity after an earlier period of apparent dormancy has already drawn attention from analytics firms. Continued deposits indicate the exploiter has not halted operations, which typically increases the urgency of any active tracing or legal coordination involving the affected protocol and law enforcement.

What remains to be confirmed

Several material details are outstanding as of this reporting. The specific amount deposited in this latest batch has not been confirmed. The destination wallet or platform has not been publicly identified. No official statement from the Drift protocol team or relevant law enforcement agency has been issued in connection with this specific movement.

Verifiable confirmation of this deposit would require a transaction hash linked to the known exploiter address, a USD-equivalent amount at the time of transfer, and identification of the receiving address or contract. Those details should be traceable through Etherscan once the specific transaction is identified and made public by security researchers.

Future updates on this story should be anchored in verifiable on-chain records or statements from the parties directly involved in the incident response. The original exploit, which resulted in losses of $285 million to the Drift protocol, established the baseline for all subsequent fund tracking, and any confirmed movement reduces the total unaccounted balance that investigators are working to trace.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.