Tornado Cash processed 968 deposits on July 23, its busiest day of 2026, according to data from L2Beat.
The surge points to the return of large-scale attackers to the privacy protocol after the U.S. Treasury lifted sanctions in March 2025. It also shows baseline usage continuing to climb while developer Roman Storm awaits a retrial tied to allegations over operating the protocol.
29,573 ETH moved into Ethereum pools in one day
Onchain data shows that 110 addresses deposited a combined 29,573 ETH into Tornado Cash’s Ethereum pools on July 23. At that day’s prices, the total was worth about $57.2 million.
Most of the funds came from one address. The wallet labeled Drift Exploiter 4 made 245 deposits totaling 23,095 ETH, or about $44.4 million, in under two hours. That accounted for 78% of the day’s inflow.
Onchain tracker Lookonchain wrote on X on July 24: "The Drift Protocol exploiter who stole $285M has deposited 23,095 $ETH ($44.4M) into #TornadoCash today." It added that the exploiter still holds 107,165 ETH, worth about $201 million.
Security firm PeckShield posted the same figures and said the exploiter also sent 0.85 ETH to Bybit.
First fund movement since the April 1 Drift exploit
The deposits were the first movement of funds tied to the April 1 exploit of Drift, the Solana perpetuals DEX that was drained of roughly $285 million in what the report described as the largest DeFi hack of 2026.
Blockchain forensics firms including TRM Labs and Elliptic have attributed the attack with medium-to-high confidence to UNC4736, a North Korea-linked cluster that has also been tied to the $1.5 billion Bybit hack.
Usage remains elevated even without the exploiter’s activity
Even excluding that address, the remaining 723 deposits from 109 other addresses still exceeded most full-day totals seen in 2025. For comparison, Tornado Cash recorded 177 deposits in total on July 23, 2025.
Recovery has continued since OFAC removed sanctions
Tornado Cash usage has been recovering steadily since the Treasury Department’s Office of Foreign Assets Control removed the protocol from the sanctions list in March 2025. The move followed a Fifth Circuit ruling that immutable smart contracts cannot be sanctioned.
According to TRM Labs, Tornado Cash has captured more than 20% of crypto mixing volume in 2026, with weekly inflows ranging from $10 million to $80 million. That compares with about 16% in the years following the 2022 sanctions.
Even so, the 2026 high remains below the level seen on Nov. 5, 2025, when Richard Heart-linked wallets helped drive 1,363 deposits in a single day.
Roman Storm case is still moving through court
The rebound in usage is unfolding while Storm’s legal case continues. Prosecutors are seeking an October retrial on money-laundering and sanctions-conspiracy charges after a Manhattan jury failed to reach a verdict on those counts in August 2025.
At the same time, Judge Katherine Polk Failla is weighing Storm’s bid for acquittal on the single count where jurors returned a conviction.