The Tornado-funded BTC-long, ETH-short trade on Hyperliquid: 3,100 ETH out of the mixer, and one thief with enough notes to have put it in

The wallet 0x45d78aec95c24b99cc8641a5b25c910d8b7c00ca had no history before 7 November. At 14:44 UTC it received 0.098 ETH from Tornado's 0.1-ETH pool through a relayer, enough gas to act on its own. From 14:50 to 16:05 it withdrew 31 notes from the 100-ETH pool itself, one about every two and a half minutes. Between 16:06 and 16:14 it sold the 3,100 ETH in four CoW Swap orders (500, 500, 1,000 and 1,100 ETH) for 6,923,865 USDC, and at 17:07 sent 6,923,765 USDC to Hyperliquid through Circle's CCTP. Hyperliquid credited the account at 17:20.

On Hyperliquid the same address opened a 20x long on Bitcoin and a 20x short on Ether of roughly equal size: a bet that Bitcoin beats Ether, not on the market's direction. Lookonchain reported 169.47 BTC long and 5,740 ETH short; by 15:30 UTC on 9 November the account had grown it to 263.8 BTC long at $75,783 and 8,945.7 ETH short at $2,234, with about $4.73M of margin.

A Tornado note is a receipt for one deposit; withdrawing it reveals nothing about which deposit it was. What a withdrawal does reveal is the size of the stack behind it: 31 hundred-ether notes withdrawn in 75 minutes by one wallet means one owner held at least 31 notes. We listed every deposit into the 100-ETH pool from 1 October to 9 November, 1,576 of them, and grouped them by the address that made them.

Five addresses put in 31 notes or more. The two largest by far are the Drift Protocol exploiter's wallets 0xaa843ed65c1f061f111b5289169731351c5e57c1 (257 notes on 20 October) and 0xd3feed5da83d8e8c449d6cb96ff1eb06ed1cf6c7 (248 notes on 21 October): 50,500 ETH, a third of every hundred-ether note deposited in those six weeks. The others are a wallet that has used Tornado regularly since February (75 notes), a wallet funded by two unlabelled addresses in late October (43), an unlabelled wallet with 51 notes on 13 October, and the Triple-A treasury attacker with 49 notes on 9 October. Between 20 October and the morning of 7 November the pool paid out 537 notes, so most of Drift's 505 are still waiting.

The trade is consistent with the Drift exploiter, who stole about $285M in April 2026 and has moved tens of thousands of ether through Tornado since July: it is the only known thief that holds enough unspent hundred-ether notes, and one of the candidate exits we flagged after its July wave also went to Hyperliquid. But "consistent with" is all the chain allows. Tornado exists to make this exact link unprovable, the pool is shared, and a large private depositor could equally be the source. We record the trader as a possible Drift exit, not as the Drift exploiter.

What can be acted on is the account itself: it holds about $4.7M of margin on Hyperliquid, and the money reached it through CCTP, a Circle product, minutes after leaving CoW Swap. Anyone with a claim on Drift's funds now has a live, specific account to point to.

It does not say who controls the account, that it belongs to the Drift exploiter, or that Tornado Cash, CoW Swap, Circle or Hyperliquid did anything wrong. Lookonchain's, Hyperdash's and Bitbase's reports are theirs. The withdrawal path, the position and the census of the 100-ETH pool are PublicAML's own reading of Ethereum and Hyperliquid on 9 November 2026.