SECURITY ALERT

The money came out of a mixer.

Then it picked a side.

A wallet created on Saturday took 3,100 ETH out of Tornado Cash, swapped it for about $6.92 million in USDC, moved it to Hyperliquid and, by 06:07 UTC on Sunday 8 Nov, had built a long bitcoin position worth about $20 million and a short ether position of about the same size, according to Ethereum records on Blockscout and Hyperliquid’s public account data.

The on-chain analytics account Onchain Lens says the wallet belongs to the attacker behind the Drift exploiter’s Tornado Cash deposits in October.

That link has not been confirmed by Drift, now operating as Velocity, or by any authority.

Tornado Cash is a mixer. It breaks the visible trail between deposit and withdrawal, which is exactly why a label on the far side is hard to test.

The timeline, in UTC

  • 7 Nov, 14:50 to 16:05. Tornado Cash’s 100 ETH pool pays the address 31 times, 3,100 ETH in all, by our reading of Blockscout records.
  • 7 Nov, 16:06 to 16:14. Four CoW Swap orders sell 500, 500, 1,000 and 1,100 ETH.
  • 7 Nov, 17:00 to 17:20. The USDC crosses to Hyperliquid through Circle’s CCTP bridge. Hyperliquid’s ledger shows about 6.92 million USDC arriving at 17:20.
  • 7 Nov, 17:37. Two time-weighted (TWAP) orders start: buy 263.82 BTC and sell 8,945.744 ETH, each spread over 750 minutes, on an account set to 20x leverage.
  • 8 Nov, 01:40. Lookonchain flags “a hacker” going long BTC and short ETH, with about $12.8 million a side filled at that point.
  • 8 Nov, 01:55 to 02:04. Onchain Lens names the Drift exploiter and asks Circle and Hyperliquid to freeze the USDC and the account. The researcher Ai Yi, who posted the full order sizes, replies “Agreed” (her first post translated from Chinese).
  • 8 Nov, about 06:07. Both orders finish filling, Hyperliquid’s data shows.

The $26 million figure in early reports was a snapshot of orders still filling.

So how big is it now?

The position

At 10:50 UTC, Hyperliquid’s data showed the account long 263.83 BTC, entered on average at $75,783, and short 8,945.744 ETH, entered at $2,234.01.

Each leg was worth about $20 million, roughly $40 million in total, against the roughly $6.92 million deposited.

Hyperliquid’s estimated liquidation prices were about $51,800 for bitcoin and about $2,923 for ether. See how liquidations work.

The trade is a bet on the ratio, not the direction. It gains if bitcoin beats ether.

Evidence ledger:

  • Ethereum and Hyperliquid account: 0x45d78AEC95C24B99CC8641a5B25c910D8b7c00ca
  • Hyperliquid TWAP orders: 2575297 (BTC) and 2575301 (ETH)

No freeze has been reported. We found no public response from Velocity, Circle or Hyperliquid by 10:50 UTC.

The Defiant also reported the trade.

Drift lost an estimated $286 million in April. Drift said it had medium-high confidence that the operation was linked to the group behind the Radiant Capital hack, which Mandiant attributed to a North Korean state-affiliated group, and Elliptic said it found indicators of a North Korean link.

If the label is right, what stops mixed money from trading on an open venue?

Protect yourself

  • Do not copy a wallet’s trades because a tracker calls it a hacker. A 20x position can be closed or liquidated without warning.
  • Treat attribution after a mixer as a claim, not a fact, until the victim protocol or an investigator confirms it.
  • Trust only official accounts for any recovery or claims process, and treat an unsolicited “Drift refund” link as phishing.

When a stolen coin can be swapped, bridged and levered in under three hours, who is supposed to be watching the door?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.