Hackers Move $61 Million in Stolen Ethereum Through Mixer

Attackers behind a massive decentralized finance exploit have awakened dormant wallets, sending tens of millions of dollars in stolen Ethereum to a cryptocurrency mixer.

According to blockchain tracking platforms Onchain Lens and Lookonchain, leveraging Arkham data, the perpetrators of the Solana-based Drift Protocol heist are actively funneling assets into Tornado Cash. The entities began transferring funds after a two-month quiet period, methodically shifting assets to avoid drawing excessive attention to their final dumping points.

The wallet identified by analysts as Drift Exploiter 5 deposited 13,400 ETH, valued around $32 million, into the mixer's contracts over the last day. Analytics firm MistTrack places the total daily laundering activity even higher, estimating that up to 25,700 ETH, worth approximately $61.5 million, was moved across associated addresses.

The culprits are executing transactions in precise 100 ETH increments. This deliberate batching aims to sever the on-chain connection between the sending and receiving addresses in the public ledger, effectively preventing automated tracking systems from following the digital trail. This marks the group's second significant laundering operation, following a July push that saw roughly $44 million routed through the same mixing service in a similar manner.

Despite these recent transfers, the hackers still retain a massive reserve. The attackers' balances currently hold between 82,000 and 94,000 untouched ETH, possessing an estimated value of up to $224 million.

State-Sponsored Tactics

The funds currently entering the shadow sector of decentralized finance stem from an exploit on April 1, 2026, which drained $285 million from the Drift Protocol in a span of just 12 minutes. TRM Labs and Chainalysis attribute the sophisticated breach to Citrine Sleet, also designated as the North Korean state-sponsored unit UNC4736.

The attackers spent six months building cover as a venture fund, interacting with developers at international conferences and depositing $1 million of their own funds into the platform's pools to establish a flawless alibi. They subsequently exploited hidden vulnerabilities in VSCode and Cursor to breach the devices of the platform's Security Council members, capturing administrative keys. The operation concluded with the release of a counterfeit CarbonVote token, utilized as fictitious collateral to extract actual platform reserves.

Limited Recovery Options

The shift of these assets into Tornado Cash signifies that affected investors face a definitive loss of any chance to recover their specific funds. While law enforcement authorities successfully intercepted and froze around $9.2 million in August, further seizures are now considered technically and legally impossible due to the mixer's obfuscation.

In response to the massive breach, the affected exchange initiated a compensation plan on October 1 utilizing DFX tokens to try and salvage its reputation. Supported by Tether, the buyback fund currently manages to cover roughly 1% of the total net losses experienced by users. The team expects to replenish this fund using future platform revenues while the stolen millions are distributed among new owners on the open market.