Deribit loses $28 million in hot wallet hack as thief launders funds via Tornado Cash - Startup Fortune
Deribit disclosed hackers drained roughly $28 million in Bitcoin, Ethereum and USDC from its hot wallets on November 1, with the thief already laundering funds through Tornado Cash.
The breach drained about 691 BTC, worth roughly $14.1 million, and close to 9,080 ETH, worth about $14.2 million, from wallets Deribit uses for day-to-day withdrawals. By November 5, the attacker had already pushed 1,610 of those stolen ETH into Tornado Cash, the Ethereum mixing service the US Treasury sanctioned in 2022.
Laundering Pattern
The transfers weren't subtle. PeckShield and other trackers watched the hacker move the Ether in 17 separate transactions, sixteen of exactly 100 ETH and one of 10 ETH, a pattern built for speed rather than stealth. That's about 17.7% of the stolen ETH gone into the mixer so far, leaving roughly 7,500 ETH still sitting in the attacker's wallet.
Once funds clear Tornado Cash, tracing them gets close to impossible. The protocol breaks the on-chain link between a deposit and a withdrawal, which is exactly why regulators sanctioned it in the first place, and exactly why hackers keep using it anyway, sanctions or not.
Exchange Response
Deribit, the Panama-based exchange that dominates crypto options trading, said the intrusion was contained to its hot wallets. The exchange keeps 99% of client assets in cold storage, untouched by this attack, and said it would cover the entire loss from its own balance sheet rather than tapping its separate $40 million insurance fund.
Withdrawals were frozen immediately after the hack, including for third-party custodians Copper, Clearloop and Cobo, while Deribit ran security checks. When withdrawals reopen, every deposit address for BTC, ETH and USDC will have to be regenerated.
Industry Context
This breach comes amid rising security concerns in the crypto industry. Hacken's data put total crypto hacking losses at $1.18 billion for the third quarter of 2026 alone across 107 incidents, and DefiLlama had already logged 250 separate hacks with cumulative losses past $1 billion by September.
The single largest hit of the year came in September, when Bitget lost about $351.6 million in a breach it said its $464 million User Protection Fund would cover in full. Against that backdrop, Deribit's $28 million is a smaller number, but it lands on a venue with a stronger reputation than most platforms that get hacked.
Enforcement Challenges
The laundering trail matters as much as the breach itself. Watching a hacker run $2.5 million through a sanctioned mixer in broad daylight, while firms like PeckShield track every transaction in real time, says something uncomfortable about where enforcement actually stands.
The tools to follow the money exist. Stopping it before it disappears into Tornado Cash is a different problem entirely, and right now the hacker is winning that race.
Related
