Four years after the 2022 Pando Rings exploit, the attacker resumed activity by moving 4,000 ETH through the Tornado Cash mixer. The funds were originally converted from stablecoins, including roughly $16.98 million in DAI, into 7,548 ETH.
Conversion and lending steps
The attacker first used Aave to swap stablecoin holdings for ETH. In late October, 16.8 million USDT was supplied as collateral to borrow 5,000 ETH, after which the loan was repaid and the collateral withdrawn. The withdrawn assets were then exchanged for 7,548 ETH, consolidating the stolen funds.
Laundering via Tornado Cash
A partial deposit of 4,000 ETH was sent to Tornado Cash, while the remaining 3,548 ETH stayed outside the mixer. The deposit was made in multiple 100 ETH transactions, each valued at about $229,000.
Impact on recovery efforts
Tornado Cash obscures the link between sender and recipient by pooling funds and returning them to new addresses. This makes it harder for investigators to trace the ETH to known exchange wallets or clusters. No confirmed deposits to exchanges have been identified, and it remains unclear whether the attacker has sold the ETH.
Ongoing challenges
The continued laundering activity adds complexity to the recovery of the stolen assets. Until the mixed funds appear at identifiable exchange addresses, visibility into the final destination of the ETH remains limited.
