The 44,510 ETH Mixer Sweep and 258-Batch Execution

On-chain records confirm that a wallet labeled "Drift Exploiter 5" initiated the laundering wave on Tuesday by firing 257 batches of 100 ETH and one 10 ETH transfer into Tornado Cash. That two-hour burst cleared 25,710 ETH worth $63.1 million, leaving just 3.98 ETH in the address.

A second linked wallet resumed the dispersal on Wednesday by routing another 18,800 ETH worth $46 million into the mixer. Together, the 48-hour sweep washed 44,510 ETH valued at $109.15 million after the cluster had sat idle since August.

UNC6862 Governance Hijack vs. Drift's One-Cent Pool

The funds trace back to the April 1 exploit of Solana perpetuals exchange Drift Protocol, which lost $295.7 million across 19 tokens before the hackers bridged the loot into Ethereum. A Mandiant audit attributed the heist to North Korean group UNC6862, which compromised Drift's Security Council using durable Solana nonce accounts to pre-sign unauthorized withdrawals.

Because the attackers bypassed token freezes by converting stolen collateral into native Ether, recovery efforts have stalled. Drift opened victim claims on October 1 with just $3.1 million in its USDT recovery pool, pricing redemptions near one cent per dollar lost.

Will the Remaining $138M Loot Deepen ETH Selling Pressure?

The 44,510 ETH routed through Tornado Cash will now move to over-the-counter brokers, where North Korean laundering networks convert mixed Ether into off-chain fiat. Furthermore, on-chain trackers confirm the exploiter cluster still holds $138 million in unmixed ETH ready for subsequent mixer waves.

This illicit supply overhang hits Ethereum during its weakest institutional demand window of 2026. With U.S. spot Ether ETFs logging 15 consecutive sessions of net outflows totaling $1.08 billion in October, ongoing hacker liquidations will keep downward pressure on spot order books.