Dormant wallets tied to one of 2026’s largest crypto hacks have once again become active. Blockchain analytics firms Onchain Lens and Lookonchain have detected large-scale Ethereum withdrawals originating from wallets associated with the Drift Protocol exploit, according to data from Arkham Intelligence.
Renewed laundering activity through Tornado Cash
After a two-month pause, attackers resumed operations, transferring substantial volumes of stolen ETH to Tornado Cash, a privacy-focused mixing service. Blockchain data shows the movement of funds in deliberate tranches, a strategy aimed at minimizing price disruptions and obscuring final destinations.
An address flagged by analysts as “Drift Exploiter 5” sent 13,400 ETH—valued at around $32 million—to Tornado Cash within a single day. Independent analytics providers, including MistTrack, estimate that the sum of ETH moved across all connected wallets during the same period reached as high as 25,700 ETH, or about $61.5 million.
The attackers are known to divide funds into batches of 100 ETH before processing them through Tornado Cash. This method severs transaction trails and complicates efforts by investigators to track the stolen assets on public ledgers.
This is the group’s second large-scale laundering effort. In July, they moved approximately $44 million via Tornado Cash using a similar approach. Despite these transactions, the majority of the stolen funds remain untouched. According to current blockchain analyses, between 82,000 and 94,000 ETH—worth up to $224 million—are still held in addresses linked to the exploiters.
Mini dictionary: Tornado Cash, a decentralized cryptocurrency mixer, is designed to improve transaction privacy on Ethereum by pooling user deposits and allowing withdrawals from a different address, breaking the on-chain link between sender and recipient. It has been widely used for both legitimate privacy purposes and for laundering stolen crypto assets.
| Period | ETH Laundered | USD Equivalent |
|---|---|---|
| July 2026 | ~22,000 ETH | $44 million |
| October 2026 | Up to 25,700 ETH | $61.5 million |
| Remaining | 82,000 – 94,000 ETH | Up to $224 million |
Drift Protocol hack: A landmark DeFi breach
The Ethereum being laundered today stems from the April 1, 2026 attack on Drift Protocol, a decentralized derivatives platform built on Solana. In just 12 minutes, the protocol suffered losses of $285 million, setting a new precedent in DeFi security incidents.
According to post-mortem analyses, the hackers exploited hidden vulnerabilities in popular software tools, Cursor and VSCode, to infiltrate devices belonging to members of Drift’s Security Council. By acquiring privileged admin keys, the attackers gained control over core platform functions. The breach culminated in the deployment of a counterfeit CarbonVote token, which served as fake collateral, enabling the extraction of real liquidity from the protocol.
Drift Protocol’s security review highlights that the exploit showcased a “rare level of planning and technical sophistication,” combining multiple attack vectors and several layers of deception.
For Drift’s investors, seeing the stolen Ethereum reappear in mixers effectively signals the loss of any realistic chance of recovery. In August, authorities managed to freeze only $9.2 million, with the majority of assets now circulating in the open market under different identities.
Recovery efforts and investor compensation
Drift Protocol has initiated a compensation plan for affected users, funded through its native DFX tokens. Tether provided initial support for the buyback fund, but current coverage stands at only about 1 percent of total user losses.
The development team has pledged to channel future platform revenues into replenishing the compensation fund, aiming to gradually close the recovery gap as stolen funds seep back into market circulation.
Platform representatives emphasize their ongoing commitment: “We are working to rebuild user trust and restore losses, but the scale of the attack presents complex challenges.”
