Tornado Cash processed 968 deposits on July 23, its busiest day of 2026, according to L2Beat data.

The spike shows large-scale attackers have returned to the privacy protocol since the U.S. Treasury lifted sanctions in March 2025 — and that its baseline usage keeps climbing even as developer Roman Storm awaits a retrial over operating it.

Depositors moved 29,573 $ETH, worth about $57.2 million at July 23 prices, into the mixer's Ethereum pools that day across 110 addresses, per onchain data. Most of it came from one: the address labeled Drift Exploiter 4 made 245 deposits totaling 23,095 $ETH, about $44.4 million and 78% of the day's inflow, in under two hours.

"The Drift Protocol exploiter who stole $285M has deposited 23,095 $ETH ($44.4M) into #TornadoCash today," onchain tracker Lookonchain wrote on X on July 24. "The exploiter still holds 107,165 $ETH ($201M)."

Security firm PeckShield posted the same figures, noting the exploiter also sent 0.85 $ETH to Bybit.

Drift Money on the Move

The deposits were the first movement of funds from the April 1 exploit of Drift, the Solana perps DEX drained of roughly $285 million in the largest DeFi hack of 2026. Blockchain forensics firms including TRM Labs and Elliptic have attributed the attack with medium-to-high confidence to UNC4736, the North Korea-linked cluster behind the $1.5 billion Bybit hack.

Even setting the exploiter aside, the day's remaining 723 deposits from 109 other addresses exceeded most full days in 2025, when July 23 of that year saw 177 deposits total.

Post-Delisting Rebound

Tornado Cash usage has rebounded steadily since Treasury's Office of Foreign Assets Control delisted it in March 2025, following a Fifth Circuit ruling that immutable smart contracts can't be sanctioned. The mixer has captured more than 20% of crypto mixing volume in 2026, with weekly inflows of $10 million to $80 million, according to TRM Labs — up from about 16% in the years after the 2022 sanctions. The 2026 peak still trails Nov. 5, 2025, when Richard Heart-linked wallets helped drive 1,363 deposits in a day.

Storm's case continues alongside the rebound. Prosecutors are seeking an October retrial of Storm on money-laundering and sanctions-conspiracy charges after a Manhattan jury hung on those counts in August 2025, while Judge Katherine Polk Failla weighs his acquittal bid on the single count where jurors convicted.