The dormant wallets associated with one of this year’s most significant crypto heists are once again exhibiting movement. Blockchain trackers Onchain Lens and Lookonchain have documented a significant withdrawal of Ethereum that was stolen this spring from the decentralised platform Drift Protocol, according to data. After a two-month period of total inactivity, the attackers reactivated the addresses they controlled and commenced a systematic transfer of assets to the Tornado Cash mixer. Dirty” ether is entering the market, released in increments to mitigate abrupt fluctuations in the exchange rate and to prevent attracting undue attention to the ultimate disposal locations. In the last 24 hours, an address identified by analysts as Drift Exploiter 5, which is under the control of hackers, executed a transfer of 13,400 ETH to the contracts of a mixer, amounting to roughly $32 million.
A number of analytics platforms, including MistTrack, estimate the total daily activity across related wallets even higher, at up to 25,700 ETH. The attackers are employing the traditional strategy of controlled obfuscation, transferring funds in increments of precisely 100 ETH. This severs the direct connection between the sender and recipient in the public ledger, rendering subsequent automatic tracking unfeasible. The current transactions represent the second significant laundering attempt; in July, the hackers extracted approximately $44 million through the mixer in a comparable fashion. Meanwhile, a significant portion of the assets remains unutilised, with an estimated 82,000 to 94,000 ETH, valued at up to $224 million, held in the attackers’ accounts. The assets currently transitioning into the shadow sector of DeFi were misappropriated on April 1, 2026, when the Solana-based exchange Drift Protocol experienced a depletion of $285 million in a mere 12 minutes. This incident has become a case study in cybersecurity literature due to its unparalleled degree of preparedness.
TRM Labs and Chainalysis report that the attack was executed by the North Korean state-sponsored group UNC4736, referred to as Citrine Sleet. The scheme unfolded over a period of six months: the hackers presented themselves as a legitimate venture fund, engaged in personal communications with developers at international conferences, and deposited $1 million of their own funds into the exchange’s pools to establish a convincing alibi. Subsequently, by exploiting concealed vulnerabilities in Cursor and VSCode, they infiltrated the devices of the platform’s Security Council members and captured administrative keys. The final touch was the issuance of a counterfeit CarbonVote token, which the perpetrators utilised as spurious collateral to extract genuine reserves.
For the affected Drift investors, the emergence of Ethereum in mixers signifies a conclusive forfeiture of any opportunity to recover their funds. In August, law enforcement succeeded in intercepting and freezing approximately $9.2 million; however, the incorporation of the majority of the capital into Tornado Cash renders any additional seizure both legally and technically unfeasible. The exchange is endeavouring to preserve its reputation: a compensation program utilising DFX tokens was initiated on October 1. However, at this stage, the buyback fund, formed with Tether’s support, addresses merely around 1% of users’ net losses. The team anticipates replenishing it through the platform’s forthcoming revenues, as the misappropriated millions are progressively allocated to new proprietors in the open market.
