Crypto Money Laundering: How Stolen Crypto Gets Cleaned
Where Does Stolen Crypto Go After a Hack?
Can stolen crypto be traced? Mostly, yes. Stopping it is the harder part.
Crypto money laundering is the process of hiding where stolen coins came from so they can be spent. It's back in the news. Between October 20 and 21, 2026, the Drift Protocol attacker sent about $109 million of ETH into Tornado Cash. On October 22, security firm Blockaid warned that flash loans can bury risky funds inside normal DeFi activity.
This guide breaks down crypto money laundering step by step: how hackers launder crypto, how mixers and bridges work, and what recovery really looks like. Figures are current as of October 23, 2026.
The Post-Hack Playbook
Most thieves don't cash out right away. Exchanges watch for fresh stolen funds, so rushing would give them away.
The usual crypto money laundering routine has three moves:
Split the loot across many new wallets.
Swap tokens that issuers can freeze, like stablecoins, into ETH or BTC.
Break the link between the hack and the final wallet, using mixers or bridges.
Analysis of past North Korea-linked thefts points to a rough 45-day window. Funds scatter first, then pass through mixers and bridges, then drift toward exchanges. Not every hack follows this script. The rhythm is common, though.
Mixers: How Tornado Cash Fits Into Crypto Money Laundering
Tornado Cash explained simply: it's a smart contract on Ethereum that works like a shared pot. A smart contract is code that runs automatically on a blockchain.
You deposit a fixed amount, such as 0.1, 1, 10 or 100 ETH. You get a secret note in return. Later, you withdraw the same amount to a fresh address. A zero-knowledge proof shows you own a deposit without revealing which one.
Everyone's deposits of that size sit in one pool. An outside observer can't tell which withdrawal matches which deposit. That's how Tornado Cash works in short. It's one tool in crypto money laundering, not the whole toolkit.
Big thefts get chopped up for this reason. Wallet records from the Drift attacker's July run show batches of 100, 10 and 1 ETH. On October 20 alone, one wallet made 258 deposits.
A mixer isn't invisible, though. Deposits stay public. Small slips, like reusing an address or withdrawing at predictable times, can link the steps. In one October 2026 wallet-theft case, some withdrawals reused deposit addresses, which tied the trail together.
The legal picture is messy. The US Treasury lifted its Tornado Cash sanctions in March 2025 after a court ruling. Developer Roman Storm was convicted in August 2025 of conspiring to run an unlicensed money-transmitting business. His retrial on the remaining charges is set for April 26, 2027.
Chain-Hopping and Bridges
Chain-hopping is a core crypto money laundering tactic. It means moving funds from one blockchain to another. A bridge is a service that locks tokens on one chain and releases matching value on another.
Every hop adds a new ledger to follow, often with different tools. Swap networks and decentralized exchanges add more steps. After the April 2026 KelpDAO bridge exploit, about $175 million in ETH reportedly moved through the THORChain swap network. That came after a security council froze part of the stolen funds.
In crypto money laundering, speed and variety matter more than perfection. Each extra hop costs the thief a little and costs investigators time.
Peel chains and flash loans
A peel chain is a common crypto money laundering pattern: a long string of transactions. At each step, a small slice peels off to a new address while the bulk moves on. It looks like ordinary activity, but it leaves a pattern.
Flash loans are a newer worry. A flash loan lets someone borrow a huge sum and repay it inside one transaction. Blockaid said an attacker borrowed over $1 billion across three Aave V3 markets on September 6, 2026. The goal was to drain about $250,000 from Balancer V1.
Blockaid also said the attacker’s address was funded from Tornado Cash hours earlier. Its warning is that compliance tools watching balances can miss money that moves through lending markets and leaves no balance behind. Blockaid sells monitoring products, so read this as an industry view, not a verdict.
The loan itself wasn’t crypto money laundering. The risk is what can hide inside such flows.
Case Study: The Drift Exploiter’s $109M
Drift is a Solana-based derivatives exchange. It was hit on April 1, 2026. Reported losses range from about $285 million to $295 million, depending on who counts. Security firms have linked the attack to North Korea-linked actors.
Date | Event | Amount |
April 1, 2026 | Exploit | ~285M–295M |
July 23–24 | First Tornado Cash run | 23,095 ETH (~$44.4M) |
October 20 | Second run, in about two hours | 25,700 ETH (~$61M) |
October 20–21 | Two-day total | 44,510 ETH (~$109M) |
After months of silence, the crypto money laundering began in bursts. Tracking accounts put the two-day total at roughly $109 million.
Here’s the key point. A Tornado Cash deposit doesn’t mean the money is cashed out. Withdrawals are the next thing to watch. Analysts estimated roughly $195 million in ETH still sat unmoved after the October 20 batch. Later transfers would cut into that figure.
This case shows crypto money laundering as a patient process, not a single event. That’s an analyst reading, not confirmed intent.
The Defenders: Forensics Firms and Freezes
Stolen crypto tracking works because public blockchains keep every transaction. Forensics firms studying crypto money laundering group wallets that likely share an owner, then flag deposits that touch exchanges. The hard part isn’t seeing the money. It’s linking wallets to real people.
Freezes are the main weapon:
Exchanges can lock accounts that receive tainted funds.
Stablecoin issuers can freeze tokens at the contract level.
Some networks have councils that can pause suspicious funds.
Shared alert systems warn platforms before withdrawals clear.
Drift also offered a public bounty of 10% of any funds recovered.
Recovery: What Actually Comes Back
Not much. By October 1, about $9.2 million of Drift’s roughly $295 million had been frozen. That’s about 3%. Drift opened claims for its recovery token the same day, with a first redemption reported near 1.04% of verified losses.
Speed explains the gap. Funds frozen within days have a real chance of coming back. Once coins pass through a mixer and into over-the-counter brokers, recovery gets rare. Crypto money laundering works because delay favours the thief.
If you’re a victim, report to the affected exchange and law enforcement fast. Save every transaction hash.
Conclusion
Crypto money laundering leaves a public trail, but a good launderer makes it expensive to follow. Mixers hide links, bridges add hops, and flash loans can disguise sources inside normal DeFi flows.
The Drift case shows the pattern at scale: long pauses, then bursts of activity. What remains uncertain is where the Tornado Cash withdrawals end up and how much gets frozen. Watch for exchange freezes, court rulings on mixers and Drift’s recovery updates. Understanding crypto money laundering helps readers judge hack headlines more clearly.
Disclaimer: This article is for information only and is not financial or legal advice. Crypto assets are volatile and high-risk. Figures come from public reports as of October 23, 2026 and may change, so do your own research.
