tornado

According to monitoring by PieShield, the wallet address of the Aperture Finance attacker transferred 1242.7 ETH (approximately 2.4 million USD) to Tornado Cash.Previously, it was reported that Aperture Finance was attacked on January 25, 2026, affecting its V3/V4 contracts and resulting in a loss of approximately 3.67 million USD.

According to Pie Shield monitoring, the hacker John (Lick), suspected of participating in the $90 million theft from the U.S. government in 2024, has begun depositing funds into Tornado Cash, with 11,037 ETH (approximately $33 million) already transferred to the mixer.Pie Shield stated that this individual is also related to a series of thefts targeting unidentified victims between November and December 2025.

According to Onchain Lens monitoring, after a year of silence, the Coinbase Commerce hacker (0xFe7...06F8) exchanged 5.9 million DAI for 2,038 ETH at a price of $2,894, and then transferred this batch of ETH through Tornado Cash.

According to market news, multiple Tornado Cash deposits have been identified in the Saga hacking incident. Before entering Tornado Cash for mixing, approximately 6.2 million dollars of stolen funds were first concentrated and dispersed into 5 wallet addresses, and then transferred through multiple transactions.

According to on-chain analyst Specter, the Huione Group in Cambodia has been continuously transferring tokens from associated addresses over the past 15 hours. As of now, a total of 1,017 ETH and 212 BNB have been deposited into Tornado Cash, worth approximately $5.19 million. The tokens in the associated wallet have been mostly emptied.

According to monitoring by the crypto regulatory technology company Bitrace, the TornadoCash business address generated a total income of 693,412 ETH tokens during 2025, with a total value of approximately 2.5 billion USD; in USD terms, the protocol had a net inflow of funds amounting to 1.4 billion USD in 2025, with the inflow dominated by ETH tokens, indicating that at least in the Crypto-native sector, industry participants' demand for privacy transfers in Ethereum exceeds that for stablecoins.Furthermore, the data above shows that after experiencing the OFAC sanctions turmoil, the protocol still maintains a certain level of industry influence.

According to Lookonchain monitoring, the Truebit hacker (0x743...9fE) has deposited all 8,535 stolen ETH into Tornado Cash for money laundering, with a total value of approximately 26.44 million USD.

According to crypto analyst Cryptosolv, the TVL of the 100 ETH pool on Tornado Cash has decreased by 40% in the past week, with 120,600 ETH transferred.In response, Onchain Lens stated that the related address belongs to crypto developer Richard Heart, and this wallet may be associated with his new project ProveX. Over the past 4 months, he has transferred 162,937 ETH through Tornado.Public information shows that ProveX aims to achieve completely trustless, peer-to-peer (P2P) cryptocurrency transactions and settlements using Zero-Knowledge Proofs technology.

According to on-chain analyst Yu Jin's monitoring, the calculation verification platform Truebit was hacked two days ago, resulting in the theft of 8,535 ETH due to a vulnerability. The hacker laundered the funds ($26.36 million) through Tornado Cash.

Vitalik Buterin expressed support for Tornado Cash developer Roman Storm. Roman Storm was convicted in 2025 for conspiring to operate an unlicensed remittance business and is currently facing up to five years in prison. In his letter, Vitalik Buterin emphasized that privacy tools are a necessary defense against systemic data exploitation and revealed that he has used the software multiple times to support human rights charities.As of 2026, Roman Storm's legal defense fund raised over $6.39 million in 2025. Previously, Vitalik Buterin donated 50 ETH, worth approximately $170,000, in 2024. The Ethereum Foundation also donated $500,000 in 2025 and pledged to provide up to $750,000 in matching donations for community contributions. Currently, global law enforcement actions against privacy-focused crypto tools are escalating, and the founder of Samourai Wallet was also sentenced to four to five years in prison in 2025.

According to MistTrack monitoring, the attacker responsible for the Upbit hack, which resulted in a loss of approximately $36 million (address starting with 0x93A0), is continuously transferring funds to Tornado Cash. So far, 1,400 ETH has been transferred.

CertiK Alert stated that suspicious transactions were detected in the Fusion PlasmaVault contract. During a withdrawal call, the newly configured "fuse" contract transferred all funds (approximately $267,000) to the EOA address 0x9b1b, which then cross-chain transferred the funds to Ethereum and deposited them into Tornado Cash.

According to MLM monitoring, among the wallet address clusters associated with Tornado Cash, the first batch of 262,400 HYPE (approximately 6.9 million USD) has been unlocked (unstaked) and has immediately begun to be sold off.Previously, on January 2, after being silent for over 12 months, the aforementioned entity unstaked 631,889 HYPE (approximately 20.3 million USD) within 3 days through 3 different wallets. All HYPE held by this entity was purchased within three weeks after the TGE ended, and the funds came from Tornado Cash. Its total holdings exceed 4.36 million HYPE, and the amount unstaked this time accounts for about 14% to 15% of its total holdings.

According to CertiK monitoring, the address starting with 0xc946 deposited 1,337.1 ETH (approximately 3.9 million USD) into Tornado Cash. The source of funds for this address may involve suspicious withdrawals of Wrapped ETH and Story tokens from compromised multi-signature accounts.

According to CertiK Alert monitoring, an attacker deposited 95 ETH into Tornado Cash, worth approximately $280,000.Previously, an uninitialized EIP-7702 delegate contract was initialized, granting the attacker the owner role, who then withdrew all funds from the delegator's address.

Confidential computing network Arcium member @milianstx posted that using Tornado Cash can result in user wallets being flagged across hundreds of applications, rendering these applications unusable.@milianstx calls on users not to mix their funds with North Korean hackers.

According to on-chain analyst Yu Jin's monitoring, a whale/institution that lost 50 million USDT to phishing has sent a message to the phisher, stating that they are willing to offer 1 million dollars as a white hat bounty if the 50 million USDT taken can be returned.As of now, the phisher has not responded, but it is highly unlikely that they will return the money, as it has long been converted to ETH and washed away through Tornado.

According to SlowMist monitoring, the scammers who obtained 50 million USDT through a "transfer record poisoning attack" began to transfer the funds within 30 minutes after receiving them.The scammer first exchanged 50 million USDT for DAI via MetaMask Swap, then converted all DAI into 16,690 ETH, and finally deposited all the funds into the mixing service Tornado Cash. Previously, it was reported that a user suffered a loss of approximately 50 million dollars due to a "transfer record poisoning attack."

According to CertiK Alert monitoring, a certain wallet has deposited 4,250 ETH (approximately 14 million USD) into Tornado Cash. The funds can be traced back to an attack incident targeting an individual with the username "Babur," which has confirmed losses of 19.5 million USD.

According to the monitoring by PieShield, the Bunni attacker address deposited 2,295.8 ETH (worth 7.3 million USD) into TornadoCash. Previously, the Bunni team suffered a vulnerability attack on September 2, resulting in a loss of approximately 8.4 million USD. The team has announced that it will disband in October.