Those exploiting the money laundering scheme continue to operate on an extremely large scale
After about two months of inactivity, wallets linked to the Drift Protocol security vulnerability transferred a large amount of ETH into Tornado Cash, with the current widely circulated amount being $61.5 million, but it doesn't stop there.
10/22/20264 min read
Three tracking systems and three different numbers.
Lookonchain reported 25,700 ETH, approximately $61.56 million, being sent in over a period of two hours. Onchain Lens recorded at least 13,400 ETH, approximately $32 million. Salus observed a single wallet sending 19,600 ETH, approximately $46.81 million, across 196 separate transactions. These are not three reports of the same event that could be combined, nor are they necessarily contradictory. Each company grouped a different set of addresses belonging to the attacker, and each recorded a different timeframe for an ongoing operation.
The remaining balance figures are inconsistent across different platforms. Lookonchain estimates the remaining balance at approximately 81,864 ETH, or about $195 million. Onchain Lens shows around $224.59 million. Salus tracks an address ending in 57c1 that is still holding 6,114 ETH. None of this information determines the total amount the attacker holds, as no third party knows the complete set of addresses.
The 196-transaction pattern is operationally significant. Tornado Cash pools accept fixed denominations, so a large sum of money must be divided into many equal deposits, and anonymity is achieved by the number of unrelated deposits with the same amount in the pool within the same timeframe. A series of 196 deposits in a short period from a single source would compromise the anonymity of that source itself. The attacker is trading security quality for speed, which often suggests a deadline or the belief that time is running out.
Why the two-month pause?
This kind of temporary shutdown is a common tactic, not a sign of hesitation. Stolen funds sitting idle without being used will create a gap with the traceability work being done in the days following the incident, the exchange's compliance alerts will expire and no longer be taken seriously, and the attention of blockchain analytics firms will shift to more recent events.
Drift said Mandiant attributed the attack to UNC6862, an organized crime group from North Korea, and that the group's patient, cyclical money laundering methods, spanning months, are characteristic of this group. Continuing after precisely the time necessary for an incident to no longer be under close scrutiny is a deliberate choice, not a coincidence.
It has a significant impact on community trust.
Functionally, nothing good has come of it. Chainalysis estimated the April theft at $285 million, and Drift itself listed approximately $295.7 million worth of stolen tokens. Funds injected into Tornado Cash in properly structured tranches are not recoverable through tracing, and the actual recovery path for victims never runs through the blockchain anyway. This works through a compensation program that Drift launched on October 1st, issuing one DFX token for each verified lost USDT against a total supply of nearly 299.5 million, backed by a recovery fund holding approximately 3.1 million USDT at launch, with Tether committed up to $127.5 million and other partners up to $20 million. Claims remain open until January 1st, 2028.
The key point of this structure is that the DFX's exchange value depends on the fund balance relative to the available supply, thus the tokens have no guaranteed face value. Victims hold the right to claim compensation for the fundraising effort, not for the stolen assets. Each distribution passed through the mixer makes the gap between the committed support and the total loss permanent rather than temporary, which is why information on money laundering is important to claimants even though the recovery mechanism never relies on tracing the origin.
Assessment and Conclusion
Tornado Cash continues to process this volume of transactions despite its history of sanctions because the contracts are immutable and the protocol doesn't require anyone's cooperation to operate. The execution surface is the exit point, meaning the exchanges and bridges where the laundered ETH is ultimately converted, and that's where the real work takes place. For a state-backed operator with access to decentralized conversion channels, that surface is thinner than for ordinary criminals, which is why the structure allows North Korean operations to convert stolen currency at a speed that ordinary thieves cannot achieve.
Let's see if the remaining balance continues to move in similar-sized tranches in the coming weeks. If so, this activity is proceeding on a schedule, and the practical conclusion for Drift claimants is that the DFX pool is the only recovery option available.
Disclaimer: The content in this article is for informational, research, data analysis, and reference purposes only regarding the cryptocurrency market. All opinions, assessments, forecasts, or opinions reflect the author's perspective at the time of publication and do not constitute investment advice, solicitations for buying or selling, trading recommendations, advertising, marketing, or promotion of any financial products, services, or cryptocurrencies. Mentions of projects, tokens, protocols, exchanges, wallets, or cryptocurrency service providers (CASPs) are for research, analysis, or informational purposes only and should not be construed as endorsements, recommendations, or guarantees in any way. HCCVenture does not broker, advertise, market, promote, or connect users in Vietnam with any cryptocurrency services from CASPs. HCCVenture does not accept asset custody, investment mandates, manage assets, or execute transactions on behalf of clients. All investment decisions are made entirely through the reader's own research (DYOR), evaluation, and responsibility; HCCVenture is not liable for any losses or damages arising from the use of or reliance on the information presented in this article.
Compiled and analyzed by HCCVenture
Join our information channels: https://link3.to/holdcoincventure
Explore HCCVenture group
HCCVENTURE QUANT JSCO
© 2026 HCCVENTURE. ALL COPYRIGHTS RESERVED.
Connect with us
Popular content
Contact to us
Address: 8th Floor, Bach Dang Complex Building, 50 Bach Dang Street, Hai Chau Ward, Da Nang City, Vietnam.
Phone: 1900 1509
Gmail : sp_contact@hccventure.com
Disclaimer: The information on this website is for informational purposes only and should not be considered investment advice. We are not responsible for any risks or losses arising from investment decisions based on the content here.
TERMS AND CONDITIONS • CUSTOMER PROTECTION POLICY
ANALYTICAL AND NEWS CONTENT IS COMPILED AND PROVIDED BY EXPERTS IN THE FIELD OF DIGITAL FINANCE AND BLOCKCHAIN BELONGING TO HCCVENTURE ORGANIZATION, INCLUDING OWNERSHIP OF THE CONTENT.
RESPONSIBLE FOR MANAGING ALL CONTENT AND ANALYSIS: HCCVENTURE FOUNDER - TRUONG MINH HUY
Read warnings about scams and phishing emails — REPORT A PROBLEM WITH OUR SITE.
