Where stolen coins went in October 2026: four routes in one week
Between 20 and 21 October, four sets of stolen funds moved through four different routes — a mixer, a stablecoin rail to TRON, a cross-chain hop into a privacy pool and a laundering desk on Hyperliquid. Why it matters for anyone who swaps without KYC.
Stolen crypto has to go somewhere. In the week of 20 October we logged four cases in our coin-flow notes, and each one took a different road out. Together they are a fair map of how laundering works this autumn — and of why an ordinary user’s swap can get caught in the net.
Route 1: back into the mixer (Drift)
The Drift Protocol hack in April took about $295 million. For two months the exploiter’s wallets were quiet. On 20 and 21 October they sent about 44,510 ETH — roughly $109 million — into Tornado Cash in two tranches, and still held around $138 million in ETH afterwards (Crypto Briefing). The Drift Foundation had said on 1 October that about $9.2 million had been frozen (The Crypto Times).
A mixer is the oldest route and still the biggest by volume. It does not make money clean; it makes the trail expensive to follow.
Route 2: mixer, then a stablecoin rail to OTC desks (SquidSquad)
ZachXBT reported on 21 October that an institution lost about $2.84 million on BNB Smart Chain on 8 October, in a theft he attributes to the North Korea-linked group SquidSquad. The funds sat for 12 days. Then, on 20 October: 1,111.2 ETH into Tornado Cash, out to three addresses, converted to USDT and bridged from Ethereum to TRON, gathered on two TRON addresses, and passed through intermediaries to Chinese OTC desks — within minutes (crypto.news, ChainCatcher).
The speed is the point. A stablecoin can be frozen by its issuer, so the money spends as little time as possible as USDT. It is the same pattern AMLBot describes in its 2026 investigations report: stolen stablecoins are turned into assets nobody can freeze, fast (our summary).
Route 3: a cross-chain hop into a privacy pool (MORPHO)
On 21 October ZachXBT reported that two addresses of one institution lost 973,000 MORPHO, about $2.3 million, which went straight into Tornado Cash. Both thefts used EIP-7702 account delegation — a newer way for an attacker to act on behalf of a compromised wallet. One of the addresses had already been drained on 9 October: about $3.5 million in old bridge claims moved from Ethereum to Zcash through NEAR Intents and into Zcash’s Ironwood shielded pool (Lookonchain).
NEAR Intents is a cross-chain swap service we track in our catalog. Appearing on a route does not mean a service did anything wrong — routes use whatever is fast and liquid — and we do not mark its review for it. But it shows how ordinary swap infrastructure becomes part of laundering logistics.
Route 4: a laundering desk with a ticker (FreedomXMR)
On 20 October ZachXBT described FreedomXMR (ticker FXMR), a swap service that appeared on Hyperliquid Core in August 2026, as a centralized laundering service: by his review, more than 87% of its inflow volume was tied to illicit activity, with over $20 million traced to ransomware, exploits, malware and social engineering. Its operator sources Monero from KuCoin, bought the FXMR ticker at Hyperliquid’s permissionless auction for 518.28 HYPE, and likely runs a swap model similar to Wagyu’s, he wrote; he named b1exch as another such service on the same venue (crypto.news, Crypto Briefing).
Neither FreedomXMR nor b1exch is in our catalog, and they will not be. The comparison with Wagyu describes how the service is built, not an accusation against Wagyu.
What does this mean for an ordinary swap?
Most swap services screen incoming coins, and the routes above are exactly what screening tools watch. If coins you receive passed close to one of them — through a mixer withdrawal, a TRON consolidation address or a flagged hot wallet — a service that screens may hold your swap after the deposit and ask where the funds came from. That is the most common complaint we read, and it is rarely the user’s fault.
- Read the service’s screening and KYC terms before you send. We quote them word for word in each review, with the date we last read them.
- Keep your own history — where your coins came from, transaction hashes, order IDs. It is what support will ask for.
- Prefer short custody. The less time a service holds your coins, the less a screening hit can cost you.
- If a swap is held, follow our guide What to do if a no-KYC exchange freezes your funds, and write things down at once: the window for any recovery is measured in hours.