A wallet that blockchain tracker Onchain Lens says belongs to the attacker behind April’s Drift Protocol exploit finished building a roughly $40 million paired trade on Hyperliquid on Sunday: a long of about 263.8 BTC against a short of 8,945.7 ETH, each worth close to $20 million. The position pays off if bitcoin outperforms ether, and it was funded entirely with ether pulled out of Tornado Cash a day earlier.
The first alerts put the trade at about $26 million. Hyperliquid’s public account data shows it was still being assembled at that point. Two time-weighted orders kept adding to both legs overnight and finished at about 06:07 UTC.
From Tornado Cash to Hyperliquid in under three hours
Ethereum records for the address show 31 withdrawals of 100 ETH each from Tornado Cash’s 100 ETH pool between 14:50 and 16:05 UTC on Saturday. A smaller withdrawal from the mixer’s 0.1 ETH pool arrived first and covered gas.
Within ten minutes of the last withdrawal, the wallet placed four CoW Swap orders for 500, 500, 1,000 and 1,100 ETH. Together they returned about 6.92 million USDC, an average close to $2,233 per ether.
The wallet then moved the stablecoins through Circle’s Cross-Chain Transfer Protocol, starting with a $100 test and following with 6,923,765 USDC. Hyperliquid’s ledger credited the same address with $6.92 million at 17:20 UTC. Its first trade was a 0.0111 BTC purchase worth about $840.
Bigger than the first alerts showed
Lookonchain flagged the wallet early on Sunday, reporting a 20x long of 169.47 BTC and a 20x short of 5,740 ETH, about $12.8 million each. Those were partial fills.
The account’s order history on Hyperliquid shows two TWAP orders placed at 17:37 UTC on Saturday: a buy of 263.81743 BTC and a sell of 8,945.744 ETH, each set to run for 750 minutes in randomised slices. Spreading an order over 12.5 hours limits its price impact and makes it harder to spot in one large print. Both orders were marked finished a little after 06:07 UTC.
At 06:08 UTC, the account held 263.83 BTC long at an average entry of $75,783 and 8,945.74 ETH short at $2,234.01. That is about $19.99 million and $19.98 million in notional value. Combined unrealised profit was about $6,400, close to flat.
The wallet took 3,100 ETH out of the mixer on Saturday afternoon. About 14 hours after the last withdrawal, it held almost no ether on Ethereum and was short nearly three times that amount on Hyperliquid.
What the 20x label hides
The 20x figure is the leverage setting on each leg, not the account’s real exposure. Against about $6.91 million of USDC collateral, gross notional is roughly 5.8 times equity. Because the two legs offset in dollar terms, the account mostly gains or loses when the ETH/BTC ratio moves, not when the whole market does.
Hyperliquid’s own liquidation estimates at the 06:08 UTC snapshot were about $51,738 for BTC and $2,920 for ETH, but each assumes the other leg stays still. By our calculation from the margin figures the exchange reports, a rise of roughly 30% in ether relative to bitcoin, with no fresh collateral, would bring the account close to liquidation.
For scale, the long equals about 0.6% of Hyperliquid’s bitcoin open interest of 41,748 BTC at that snapshot, and the short about 0.9% of its 977,164 ETH open interest. It is a large single account, not one that dominates either market.
The Drift link rests on analyst attribution
Onchain Lens said the address “specifically belongs to Drift protocol exploiter” and tagged Circle and Hyperliquid, asking them to freeze the USDC and the account’s front-end access. Lookonchain described the trader only as “a hacker” and did not name a theft.
Tornado Cash exists to break the on-chain link between deposits and withdrawals, so the transactions above cannot confirm who controls the wallet. As of about 06:10 UTC, Hyperliquid, Circle and Drift had not posted about the address on their official X accounts.
The pattern echoes steps investigators documented in April, though mixer withdrawals and Hyperliquid trading are not unique to any one actor. Drift lost about $286 million on April 1 in an attack that TRM Labs and Elliptic linked to North Korean hackers, and our coverage of that exploit noted the attacker had funded the setup with ether from Tornado Cash and routed some stolen funds through Hyperliquid.
Freezing requests carry history here too. Circle was sued in April over not freezing about $230 million of USDC taken in the same hack, as we reported at the time. This time the dollars are already posted as margin inside a trading account.
What to watch
The next signals are whether Hyperliquid restricts the account, whether the wallet withdraws or adds collateral, and whether more 100 ETH withdrawals leave Tornado Cash toward new addresses. The ETH/BTC ratio now decides whether the trade grows or starts eating into its $6.9 million cushion.
FAQ
Is it confirmed that the Drift exploiter controls this wallet?
No. Onchain Lens made the attribution and Lookonchain called the owner a hacker, but the funds came through Tornado Cash, which hides the source. Hyperliquid, Circle and Drift had not commented publicly.
What does a BTC long and ETH short of equal size mean?
It is a dollar-neutral pair trade. It profits if bitcoin outperforms ether and loses if ether outperforms bitcoin, largely regardless of the overall market’s direction.
How much money backs the $40 million position?
About $6.91 million in USDC, the proceeds of selling 3,100 ETH withdrawn from Tornado Cash on Saturday.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
