A North Korea-linked hacker who stole $285 million from Solana’s Drift Protocol in April just moved another $109 million into a privacy mixer, nearly two months after the last transfer went quiet.
Wallets tied to the Drift exploiter sent 44,510 ETH, worth about $109 million, into Tornado Cash across October 20 and 21, according to on-chain tracking cited by crypto.news and TFTC. The transfers came in the same pattern as before: batches of 100 ETH, then 10 ETH, then 1 ETH, fed into the mixer’s router hundreds of times over. It’s the kind of repetitive, almost bureaucratic laundering that looks nothing like a Hollywood heist and everything like someone working through a checklist.
The money comes from one of the ugliest hacks of the year. On April 1, attackers drained roughly $285 million from Drift, the largest decentralized perpetual futures exchange on Solana, in about 12 minutes. They didn’t exploit a bug in the smart contracts. They exploited people. Drift says the operation took six months of preparation, with the attackers posing as a quantitative trading firm, depositing over $1 million to build trust, and meeting real contributors at crypto conferences before delivering a cloned code repository and a fake TestFlight app to compromise developer machines. Once inside, they used durable nonces to get multisig signers to pre-sign hidden authorizations, then triggered a zero-timelock migration of Drift’s Security Council, the one mechanism built to stop exactly this kind of takeover.
Drift has attributed the attack, with medium-to-high confidence, to UNC4736, the threat cluster Mandiant also tracks as AppleJeus or Citrine Sleet and links to North Korea. TRM Labs and Elliptic have pointed to the same cluster behind the $1.5 billion Bybit hack earlier this year. Solana co-founder Anatoly Yakovenko called the breach “terrifying” the day it happened, and it’s easy to see why: Drift’s total value locked fell from about $550 million to roughly $255 million within 24 hours.
The exploiter sat on the stolen ETH for almost three months before making a move. The first batch came on July 23 and 24, when 23,095 ETH, about $44.4 million, hit Tornado Cash in a single stretch that Tornado itself logged as its busiest day of all 2026, per L2Beat data. Then nothing for nearly two months. Then, starting October 20, another $61.5 million went in, followed quickly by more, pushing the two-day total past $109 million.
That stop-start rhythm isn’t an accident. Big thefts tend to sit dormant because moving large sums through a mixer in one go draws exactly the kind of attention that gets wallets flagged, frozen at exchanges, or traced the moment the ETH tries to convert back to cash. Spacing transfers out over months, in small batches, is the standard playbook for a patient launderer who assumes someone is watching every transaction.
Someone is. On-chain investigator ZachXBT has tracked the wallet since July, though he’s said he’s stepping back from following this particular case closely. Estimates of the April theft have ranged from about $270 million to $285 million across different blockchain forensics firms, several of which have kept tabs on the exploiter’s remaining balance as it shrinks with each new mixer deposit.
Here’s the uncomfortable arithmetic. After this week’s transfers, tracked wallets linked to the exploiter still held about 56,569 ETH, worth roughly $138 million, according to the same on-chain data. Add up what’s already gone into Tornado Cash, over $153 million combined across the July and October batches, and the hacker has now laundered more than half of the original haul. None of it has been recovered. None of it is likely to be.
Frankly, that’s the real story here, not the mixer itself. Tornado Cash was under U.S. sanctions from 2022 until the Treasury lifted them in March 2025 following a court ruling that OFAC had exceeded its authority, and a federal court has since blocked the agency from reinstating them. Plenty of security researchers have spent years building tools to de-anonymize its flows. None of that stopped a North Korean state-linked group from running $109 million through it in 48 hours this week. The tracing firms can watch the money move. They can label the wallets. They cannot make the ETH come back once it’s split across thousands of mixer outputs and re-aggregated on the other side.
For Drift, the practical damage was already done in April, when deposits and withdrawals froze and the protocol’s credibility took the hit. What’s happening now is just the slow-motion epilogue: a state-linked actor converting a nine-figure DeFi heist into spendable money, in public, on a block explorer anyone can watch, while the tools built to stop it log the transactions and little else.
Also read: Visa and Mesh Will Let Any Crypto Wallet Pay at 175 Million Stores • Circle stock plunges 20% on Clarity Act stablecoin yield ban fears • Oil Above $111 A Barrel Drags Bitcoin Below $82,000 In A Single Day
The Metropolix, from Startup Fortune
→
This article is posted in Crypto News, check it out for more related stories.
Almost there. Sign in and your reply posts straight away.
Click Here For The Original Source.
——————————————————–
