Cabal Desk
Search
Wallets No. 000273

Hacker Deposits $12.4M Into Tornado Cash Like It's a Crypto Laundromat

One of the two funding streams came out of Tornado Cash. On October 9, 4,970 ETH went back in.

Illustration: Hacker Deposits $12.4M Into Tornado Cash Like It's a Crypto Laundromat

On October 9, the attacker Salus links to the Triple-A breach moved 4,970 ETH, about $12.4 million, into Tornado Cash[1]. It arrived in 56 deposits: 49 of 100 ETH and seven of 10 ETH[2][3].

Salus tracked the route behind those deposits: two addresses in the middle, then one wallet that made them[4]. One of the two streams held funds pulled out of the same mixer before[5]. The 49 deposits carried 4,900 ETH; the seven carried 70 ETH[6].

What to do: what the chain shows is 4,970 ETH inside Tornado Cash, in 56 deposits[1].

Who gains, who loses

4,970 ETH into Tornado Cash across 56 deposits[1][2] the attacker gains a broken trail; anyone tracing the Triple-A breach loses the thread at the mixer.
One stream held funds pulled out of the same mixer before[5] the mixer's own payouts cycle back into it; watchers who marked those exits as finished lose that assumption.
Two addresses in the middle consolidated into one wallet before the deposits[4] watchers gain a single choke point to watch; the attacker loses the split trail.

Receipts

[1]

On October 9, the attacker linked by Salus to the Triple-A breach deposited 4,970 ETH, worth approximately $12.4 million, into Tornado Cash.

“The attacker behind Triple-A’s July treasury breach has transferred 4,970 ETH worth approximately $12.4 million into Tornado Cash, according to blockchain security firm Salus.”

[2]

The Tornado Cash transfer consisted of 56 deposits.

“4,970 ETH entered Tornado Cash on Oct. 9 through 56 deposits, according to Salus.”

[3]

The deposits comprised 49 transactions of 100 ETH and seven transactions of 10 ETH.

“Salus said its Tornado monitoring system tracked 49 deposits of 100 ETH and seven deposits of 10 ETH linked to the Triple-A attacker on Oct. 9.”

[4]

The attacker consolidated funds from two intermediary addresses through one wallet before depositing them into Tornado Cash.

“In its account of the transactions, the security firm described two streams of funds that passed through separate intermediary addresses before reaching one wallet.”

[5]

One funding stream contained funds from earlier withdrawals from Tornado Cash.

“Salus said the attacker used that wallet to make the Tornado Cash deposits, with one stream containing funds from earlier withdrawals from the mixer.”

[6]

The 49 larger deposits totaled 4,900 ETH and the seven smaller deposits totaled 70 ETH.

“The firm’s transaction breakdown puts 4,900 ETH in the 49 larger deposits and another 70 ETH in the seven smaller deposits.”

Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.