Stolen Ethereum laundering resumes as 25,700 ETH flow into Tornado Cash mixergeneric

Tornado Cash Sees $61M Flow from Drift Hack as Laundering Resumes

Hackers move 25,700 ETH through Torn Cash mixer while Mastercard and BitGo expand institutional crypto infrastructure.

October 21, 2026, 09:17 AM726 words9 sourcesAI-Generated · Reviewed by editorial team
Tornado Cash Sees $61M Flow from Drift Hack as Laundering Resumes

Photo: Pexels / Bastian Riccardi

The digital asset landscape is currently navigating a complex intersection of illicit activity and institutional evolution. On October 20, 2026, on-chain monitoring revealed that wallets associated with the massive Drift Protocol exploit have reactivated, funneling tens of millions of dollars in stolen Ethereum through the tornado cash mixer en.cryptonomist.ch. This resurgence of laundering activity coincides with a broader push for legitimacy in the sector, as major financial players like Mastercard and BitGo launch new infrastructure to bring AI-driven payments and regulated stablecoin issuance into the mainstream en.cryptonomist.ch en.cryptonomist.ch. While hackers attempt to obscure their tracks, the industry is simultaneously building the transparent frameworks required for long-term institutional adoption.

The Resurgence of Tornado Cash Crypto Laundering

After approximately two months of dormancy, the entities responsible for the $285 million Drift Protocol hack have resumed efforts to move their illicit gains. On-chain data indicates that 25,700 ETH, valued at roughly $61.56 million, began to flow into the tornado cash mixing service over a brief two-hour window en.cryptonomist.ch. These transactions were executed in precise batches of 100 ETH to leverage the mixer's liquidity pools, which effectively sever the visible link between the sender and the eventual recipient en.cryptonomist.ch.

The original exploit, which occurred on April 1, 2026, saw the decentralized derivatives platform drained of its reserves in just 12 minutes en.cryptonomist.ch. Security analysts from TRM Labs and Chainalysis have attributed the sophisticated attack to UNC4736, a North Korean state-backed group en.cryptonomist.ch. Despite the recent movement of funds, the attackers are estimated to still hold 81,864 ETH, worth approximately $195 million, in various controlled wallets en.cryptonomist.ch. Meanwhile, Drift Protocol has initiated a recovery program, though its current buyback fund covers only about 1% of the net losses suffered by users en.cryptonomist.ch.

Institutional Infrastructure and AI Integration

While bad actors utilize torn cash protocols to hide assets, established financial institutions are launching tools designed to bring transparency and utility to the blockchain. Mastercard has moved its "Agent Pay for Machines" system into early access, allowing AI agents to execute digital purchases within strictly defined human-controlled budgets en.cryptonomist.ch. In a recent demonstration, an AI agent successfully completed nine separate payments for research and marketing images, using digitally signed vouchers to ensure it did not exceed its authorized spending ceiling en.cryptonomist.ch.

Regulated Issuance and Network Growth

Parallel to these payment innovations, BitGo has introduced a Stablecoin-as-a-Service platform, enabling banks and fintech firms to issue regulated digital assets without building their own underlying infrastructure en.cryptonomist.ch. This service aligns with U.S. licensing frameworks like the GENIUS Act, though BitGo emphasizes that participating firms must still conduct their own legal and compliance reviews en.cryptonomist.ch.

The demand for such services is reflected in recent network data. The TRON network, for instance, reported that stablecoin settlement value reached $2.2126 trillion in Q3 2026, a 5.1% increase from the previous quarter en.cryptonomist.ch. TRON now accounts for approximately 73% of all stablecoin transaction volume, significantly outpacing Ethereum's 15% share in this specific sector en.cryptonomist.ch. This massive volume continues into the flow of global liquidity, with the combined supply of USDT and USDD on TRON reaching $93.88 billion en.cryptonomist.ch.

Market Outlook and Regulatory Pressures

The contrast between network growth and regulatory enforcement remains sharp. In Kazakhstan, the Astana Financial Services Authority (AFSA) has secured injunctions against six major platforms, including Coinbase and HTX, barring them from providing unlicensed services within the Astana International Financial Centre en.cryptonomist.ch. These orders are part of a broader effort to ensure that all digital asset activity within the hub adheres to anti-money laundering and supervisory requirements en.cryptonomist.ch.

Despite these localized regulatory hurdles, long-term capital assumptions from J.P. Morgan Asset Management suggest a bullish outlook for the broader economy. The firm has raised its annual return forecast for a standard 60/40 stock-bond portfolio to 7.0%, citing a $15 trillion capital spending surge driven by AI adoption and economic nationalism en.cryptonomist.ch. For the first time, the firm has also included a return range for Bitcoin in its long-term projections, although the asset is not yet part of its main covariance matrices en.cryptonomist.ch.

Investors should monitor whether the remaining 81,000 ETH from the Drift exploit continues to move through tornado cash, as large-scale laundering events often precede increased regulatory scrutiny on privacy protocols. Additionally, the November 23 mainnet launch of Stellar’s Bell Protocol 30 upgrade will be a key milestone for business-ready smart accounts and quantum-safe signatures en.cryptonomist.ch.

Related

Source Articles

This article is based on analysis of 9 source articles from our news database.

  1. 1
    En··en.cryptonomist.ch·
  2. 3
    En··en.cryptonomist.ch·
  3. 4
    En··en.cryptonomist.ch·
  4. 5
    En··en.cryptonomist.ch·
  5. 6
    En··en.cryptonomist.ch·
  6. 7
    En··en.cryptonomist.ch·
  7. 8
    En··en.cryptonomist.ch·