Stolen Ethereum laundering resumes as 25,700 ETH flow into Tornado Cash mixer

What it is

Wallets tied to the 1 April 2026 Drift Protocol theft ($285 million, drained in 12 minutes from the Solana derivatives platform) resumed laundering on 20 October 2026 after about two months of inactivity. The page gives several counts of what moved into Tornado Cash that day, and they differ by tracker.

How it works

Onchain Lens first saw 13,400 ETH (about $32 million) from an address labelled Drift Exploiter 5. Lookonchain's later update put deposits across the exploiter's wallets at 25,700 ETH (about $61.56 million) over two hours. Salus separately counted 19,600 ETH (about $46.81 million) in 196 transactions. Deposits were in batches of exactly 100 ETH, a fixed denomination that is easy to filter for. Arkham data also fed the monitoring.

This is the second major laundering round. In July 2026 the attackers sent about $44 million through the same mixer.

The original attack, per the page, ran as follows:

• Attackers posed as a venture fund for six months and attended international conferences to meet developers.
• They deposited $1 million of their own funds into Drift's pools to look credible.
• They exploited weaknesses in Cursor and VSCode to compromise the devices of Drift's Security Council members and obtain administrative keys.
• They passed off a counterfeit CarbonVote token as collateral and drained the real reserves.

TRM Labs and Chainalysis attribute the attack to UNC4736 (also called Citrine Sleet), a North Korean state-backed group.

Caveats

• The tracker figures are not reconciled, and the page does not say why they differ.
• Mixer deposits do not show that the ETH was sold or cashed out, and they do not show the final destination of the funds.
• Lookonchain estimated 81,864 ETH (about $195 million) still held by the attacker. Earlier estimates were 82,000 to 94,000 ETH, up to $224 million.
• Authorities froze about $9.2 million in August 2026.
• Drift opened DFX recovery-token claims and redemptions on 1 October 2026. A Tether-supported buyback fund covers about 1% of users' net losses, and the team expects to add future platform revenue to it.
• The page gives no patch, detection query or configuration guidance for the Cursor and VSCode weaknesses.