Drift hacker's Tornado Cash haul doubles to $122 million in 520 deposits over about 26 hours, the largest by any hacker in two years, Arkham says, with $137 million still sitting in its wallets

The laundering of the year's third-largest crypto hack has doubled in size. Arkham said on Thursday that the entity it labels the Drift Protocol Exploiter deposited about $122.3 million of ether into Tornado Cash in 520 transfers over roughly 26 hours, from 07:08 UTC on October 20 to 08:48 UTC on October 21. That is about one transfer every three minutes, and 505 of them were for exactly 100 ETH. CoinDesk's live blog carried the same Arkham figures on Thursday morning.

The figure is twice what was known on Tuesday, when Lookonchain and Cointelegraph reported about $61 million moving into the mixer, after what Cointelegraph described as two months of inactivity. Arkham's tally shows about $61.4 million went in on October 20 and $60.9 million on October 21; Arkham, which differs from Cointelegraph on the idle period, says the deposits were the entity's first movement in six months.

Arkham said the exploiter's wallets still hold about $137.2 million, including 56,568 ETH on Ethereum and about $549,000 of USDY on Solana. Arkham puts the April 1 theft at about $285 million, taken through a malicious admin transfer and bridged to Ethereum; Drift itself reported losses of about $295 million, and in June said the security firm Mandiant attributed the attack to UNC6862, a North Korean group, according to Cointelegraph. DefiLlama ranks it the third-largest hack of 2026, Cointelegraph reported.

What to watch: whether the remaining 56,568 ETH follows the same route. Drift's recovery pool for affected users held about $3.1 million at launch, and claims opened on October 1, Cointelegraph reported.