The wallets behind one of 2026’s biggest crypto heists have started emptying their pockets again. Over two days, addresses linked to the April exploit of Drift Protocol pushed roughly 44,510 ETH, worth about $109 million, into the Tornado Cash mixer.
The final leg came Wednesday, with another $46 million sent through the mixer. Even after all that, the same wallets still held about $138 million in Ether, so the cleanup crew is far from finished.
How the latest $109 million moved
The activity ran from October 20 to October 21, 2026, according to on-chain tracking of the exploiter addresses. It arrived in two tranches rather than one large dump.
The first batch was 25,710 ETH, valued at between $61 million and $63 million. The second, worth $46 million, followed the next day.
After the transfers, the exploiter addresses retained an estimated 56,569 ETH, or roughly $138 million.
A slow-motion laundering operation
This is not the first time these wallets have visited the mixer. In July 2026, around 23,095 ETH, worth approximately $44 million at the time, took the same route into Tornado Cash.
The original attack hit Drift Protocol on April 1, 2026. Drift is a decentralized exchange for perpetual futures and it runs on Solana.
Total losses from the exploit came to approximately $295 million. That figure ranks it as the third-largest theft of 2026.
Most of the stolen assets did not stay on Solana. The bulk was converted or bridged into ETH on Ethereum, which explains why the laundering is happening through an Ethereum-based mixer.
The North Korea question
Attribution work on the exploit has pointed, with medium-high confidence, toward a group linked to North Korean state actors. The group is tracked under the designations UNC4736 and UNC6862.
Victims are still waiting
Drift opened a claims process for its DFX recovery tokens on October 1, 2026, backed by a pool that started with about $3.1 million in USDT.
Measured against a $295 million loss, that pool is a rounding error. Early redemption rates have also been low, according to the research tracking the process.
No new recoveries tied to the latest laundering activity have been reported.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.