# State-Linked Hackers Launder Loot in Delayed Waves

State-linked attackers, mainly North Korean groups, will keep holding stolen crypto idle for weeks or months and then pushing it through mixers in bursts. Large hack proceeds will keep coming back as laundering events long after the theft, which tests how well exchanges, mixer policy and on-chain tracing can actually stop funds rather than just watch them move.

- Conviction: 35 / 100 (forming)
- Horizon: Emerging (watchlist)
- Tracking since: 2026-10-21T00:00:00.000Z
- Last updated: 2026-10-21T06:18:19.997Z
- Canonical: https://polylog.news/crypto/trends/state-linked-hack-proceeds-launder-in-waves
- Publisher: Polylog
- Affected regions: Global

## Recent evidence

- [confirms] Drift Exploiter Moves About $63 Million of Ether Into Tornado Cash After Two Months Idle (2026-10-21): On October 20, after two months idle, the Drift exploiter wallet made 258 deposits totaling about 25,700 ETH (about $63M) into Tornado Cash. The attacker still controls about 81,454 ETH from the April hack that investigators attribute to North Korea.