Hacker Moves 4,970 ETH From Triple-A Hit Into Tornado Cash

The numbers landed late in the session: 4,970 ETH, roughly $12.4 million at current prices, split across 49 deposits of 100 ETH and seven larger ones, all routed straight into Tornado Cash. Salus caught the flow on its monitoring system and flagged it within minutes.

The July Breach Still Casting a Shadow

Triple-A lost control of its treasury in mid-July. The attacker has sat on the ETH since then, apparently waiting for the right moment to mix it. That wait ended yesterday. The timing caught some desks flat-footed — most had assumed the coins would stay parked until the next bull run or until liquidity dried up elsewhere.

Why move now? The obvious answer is obfuscation. Tornado Cash remains one of the few mixers still functioning at scale after the U.S. sanctions drama. For anyone who has watched similar flows in 2022 and 2023, the playbook looks familiar: small batches, staggered deposits, then a long wait for the exit path to open.

How This Fits the Pattern From Earlier Hacks

Compare it with the 2022 Ronin bridge theft or the 2023 Euler Finance drain. In both cases the stolen assets sat for weeks or months before hitting a mixer. The Triple-A flow is smaller but follows the same rhythm: patience first, then rapid layering once the trail starts to cool. ETH itself has traded in a tight range since the original breach, so the attacker isn't chasing price action. The goal is clearly exit liquidity, not profit maximisation on the way out.

Still, the scale matters. $12.4 million in one afternoon is enough to move the needle on on-chain metrics for Tornado, even if it barely registers against daily ETH volume. The deposits showed up as clean, sequential transfers from an address already linked to the July incident. No drama, just steady movement.

What the Market Has Priced In So Far

ETH dipped modestly after the news broke, but the reaction stayed contained. Most spot desks shrugged; the coins were already written off months ago. Perpetual funding rates barely budged. The real impact sits in the compliance corner — custodians and OTC desks now have another tainted batch to watch for when those funds eventually surface on exchanges.

If you've been tracking mixer activity this year, the pattern is clear: once coins enter Tornado they tend to reappear on secondary markets within two to six weeks. The question is whether this batch follows the same schedule or whether the attacker has learned to sit longer.

The Questions That Remain Open

Who controls the downstream wallets? Will the funds head to a CEX in Asia or get swapped into privacy coins first? And how much of the original July haul is still sitting untouched? Salus only tracked this slice. The rest could already be moving through other routes.

Anyone watching this pair of addresses — the original breach wallet and the Tornado deposits — will be checking the mempool closely over the next few days. One more cluster of small withdrawals and the trail could go cold fast.

That kind of opacity is exactly why these flows still matter to desks that touch ETH at all. Watch your position sizing here; a sudden reappearance on a liquid venue has caught leveraged traders off guard before.