A top crypto derivatives exchange got drained, and five days later the stolen Ether is already flowing into a sanctioned mixer while blockchain trackers watch every move.

Deribit disclosed that hackers broke into its hot wallets on November 1 and made off with roughly $28 million in Bitcoin, Ethereum and USDC, the derivatives exchange said, and the thief hasn't wasted time cashing out. According to blockchain security firm PeckShield, the breach drained about 691 BTC, worth roughly $14.1 million, and close to 9,080 ETH, worth about $14.2 million, from wallets Deribit uses for day-to-day withdrawals. By November 5, the attacker had already pushed 1,610 of those stolen ETH, worth more than $2.5 million, into Tornado Cash, the Ethereum mixing service the US Treasury sanctioned in 2022.

The transfers weren't subtle. PeckShield and other trackers watched the hacker move the Ether in 17 separate transactions, sixteen of exactly 100 ETH and one of 10 ETH, a pattern built for speed rather than stealth. That's about 17.7% of the stolen ETH gone into the mixer so far, leaving roughly 7,500 ETH still sitting in the attacker's wallet. Once funds clear Tornado Cash, tracing them gets close to impossible. The protocol breaks the on-chain link between a deposit and a withdrawal, which is exactly why regulators sanctioned it in the first place, and exactly why hackers keep using it anyway, sanctions or not.

Deribit, the Panama-based exchange that dominates crypto options trading, said the intrusion was contained to its hot wallets, the funds kept online for processing withdrawals. The exchange keeps 99% of client assets in cold storage, untouched by this attack, and said it would cover the entire loss from its own balance sheet rather than tapping its separate $40 million insurance fund. Operations continue, the company said, and it remains financially sound. Withdrawals were frozen immediately after the hack, including for third-party custodians Copper, Clearloop and Cobo, while Deribit ran security checks. A company spokesperson said that when withdrawals reopen, every deposit address for BTC, ETH and USDC will have to be regenerated, a sign of how thoroughly the exchange is treating its own infrastructure as compromised.

What makes this one sting is who got hit. Deribit isn't some fly-by-night platform. It's the exchange institutional traders go to for Bitcoin and Ether options, the kind of venue whose hot-wallet security is supposed to be a solved problem by now. It wasn't.

Singapore's Triple-A, a MAS-licensed crypto payments processor, confirmed an $11.8 million hot wallet breach across seven blockchains, with attackers draining new customer deposits for over 31 hours after the first security alert. The company says client funds are unaffected, but hasn't explained how the attacker accessed private keys across seven... - crypto payment provider security breach - licensed cryptocurrency wallet fund theft

This is not an isolated year for exchange security. Hacken's data put total crypto hacking losses at $1.18 billion for the third quarter of 2026 alone across 107 incidents, and DefiLlama had already logged 250 separate hacks with cumulative losses past $1 billion by September. The single largest hit of the year came in September, when Bitget lost about $351.6 million in a breach it said its $464 million User Protection Fund would cover in full. Against that backdrop, Deribit's $28 million is a smaller number, but it lands on a venue with a stronger reputation than most of the platforms that get hit, and that's the part worth sitting with.

Frankly, the laundering trail matters as much as the breach itself. Watching a hacker run $2.5 million through a sanctioned mixer in broad daylight, while firms like PeckShield track every transaction in real time, says something uncomfortable about where enforcement actually stands. The tools to follow the money exist. Stopping it before it disappears into Tornado Cash is a different problem entirely, and right now the hacker is winning that race.

Also read: Bitcoin and Ethereum ETFs End Six Days of Outflows With $252.5M Haul • Jamie Dimon's fight against stablecoin yield just lost its best shot in Congress • Gold Falls Alongside Stocks and Crypto in a Break From Its Usual Script

This article is posted in Crypto News, check it out for more related stories.

Join the discussion