State-Linked Hackers Launder Loot in Delayed Waves
State-linked attackers, mainly North Korean groups, will keep holding stolen crypto idle for weeks or months and then pushing it through mixers in bursts. Large hack proceeds will keep coming back as laundering events long after the theft, which tests how well exchanges, mixer policy and on-chain tracing can actually stop funds rather than just watch them move.
forming · confidence 35 · Emerging (watchlist) · tracking since October 21, 2026 · updated October 21, 2026
Why the conviction moved
- Oct 21Strengthened
On October 20, after two months idle, the Drift exploiter wallet made 258 deposits totaling about 25,700 ETH (about $63M) into Tornado Cash. The attacker still controls about 81,454 ETH from the April hack that investigators attribute to North Korea.
Source trail
Supporting · October 21, 2026
Drift Exploiter Moves About $63 Million of Ether Into Tornado Cash After Two Months Idle
On October 20, after two months idle, the Drift exploiter wallet made 258 deposits totaling about 25,700 ETH (about $63M) into Tornado Cash. The attacker still controls about 81,454 ETH from the April hack that investigators attribute to North Korea.
CryptoSlate
Unlock full source trail, score history, and daily updates.
Unlock TrendsAffected regions & assets
Townsquare
Argue the thesis in Townsquare.