Drift Exploiter Launders $109 Million Through Tornado Cash Following Major Heist

The hacker known as “Drift Exploiter 5” has recently transferred around 44,510 ETH, valued at approximately $109 million, into the Tornado Cash mixer over a two-day period. This laundering operation, which took place from October 20 to October 21, 2026, involved two separate transactions: the first batch consisted of about 25,710 ETH, worth between $61 million and $63 million, followed by a second transfer of $46 million the next day.

Despite these significant transfers, the exploiter wallets still retain an estimated 56,569 ETH, equating to roughly $138 million. This is not the first instance of laundering by these wallets; a previous transaction in July 2026 saw around 23,095 ETH, valued at approximately $44 million, funneled through the same mixer.

The original exploit of the Drift Protocol, a decentralized exchange for perpetual futures on Solana, occurred on April 1, 2026, resulting in total losses of about $295 million, making it one of the largest thefts of the year. Most of the stolen assets were converted to ETH on Ethereum, necessitating the use of an Ethereum-based mixer for laundering.

Attribution efforts have suggested a potential link to North Korean state actors, specifically groups tracked under the designations UNC4736 and UNC6862. Meanwhile, victims of the exploit are still awaiting recovery, as Drift Protocol initiated a claims process for recovery tokens on October 1, 2026, backed by a pool of about $3.1 million in USDT, which is minimal compared to the total losses incurred.