News Heat Trend
Project Overview
Tornado Cash is a decentralized and non-custodial privacy solution. It improves transaction privacy by breaking the on-chain link between source and destination addresses. This is achieved through a smart contract that accepts ETH and other token deposits from one address, and enables their withdrawal from a different address.
EIP-7702 authorization exploited to move Binance wallet assets, with an additional $780M USDC transferred out
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
Ledger attacker moved nearly 3,000 ETH via Tornado Cash and Zcash, related wallets still hold approximately $38.6 million in ETH and $16.9 million in BTC
Odaily News: According to Bitcoin News monitoring, the attacker behind the Ledger supply chain theft has moved nearly 3,000 ETH through Tornado Cash in three separate transactions, and transferred the funds into the Zcash privacy pool before converting them to USDC. Investigator @YFarmX stated that despite the use of privacy tools, they have traced 108 transactions completed through Zcash by exact value matching. An estimated $2.85 million in stolen USDC is still held in 3 wallets, and Circle may be able to freeze the related funds. Meanwhile, Tether is reported to have frozen $10 million in stolen USDT; wallets associated with the attacker still hold approximately $38.6 million in ETH and $16.9 million in BTC.
Suspected Ledger Hacker Transfers 430.2 ETH to Tornado Cash
According to Onchain Lens monitoring, the suspected hacker behind the reported $90 million Ledger reseller incident has deposited 430.2 ETH, worth $1.07 million, into Tornado Cash through 4 wallets. After Tether froze the related funds, the hacker swapped USDT for USDD through SUN.io and USDD's PSM, with some funds also flowing into Binance hot wallets.The hacker's wallet tracked by Arkham currently holds a total of $70.6 million in assets, including 11,406 ETH worth $28.35 million; 213.371 BTC worth $17.65 million; 13.646 million USDD worth $13.65 million; and 10.909 million USDT worth $10.91 million. Onchain Lens is calling on Binance to investigate these transfers and freeze accounts associated with the stolen funds as soon as possible.
The U.S. Treasury Department acknowledges problems with previous mixer-related rules, Tornado Cash co-founder Roman Storm says the DOJ is still pushing for his conviction
Odaily News: Roman Storm posted on X platform stating that the U.S. Treasury Department recently acknowledged in a document that there were problems with previous rules targeting mixers, and noted that the policy may have a "chilling effect" on legitimate activities. Storm stated that although the relevant department of the U.S. Treasury Department now believes the policy has issues, the U.S. Department of Justice in his case still insists that even legitimate transactions conducted through Tornado Cash constitute illegal acts because they could be used for money laundering, sanctions evasion, and other criminal purposes. Storm said that the non-criminal division of the U.S. government believes the policy is improper, while the criminal justice division believes all related transactions constitute crimes; he has been detained and prosecuted for over 1,139 days, and claims his case stems from developing open-source code. Storm also stated that the Southern District of New York (SDNY) federal court submitted a new document today, and the U.S. Department of Justice is still pushing for his conviction.
About $295 million in user assets stolen, Drift Foundation says 107,200 ETH still not moved
Odaily News — According to monitoring by the Drift Foundation, the Drift Foundation has released an update on fund recovery progress related to the April 1 security incident: approximately $295 million in user assets were stolen. The foundation has engaged Mandiant, zeroShadow, and SEAL 911 to conduct the investigation and trace the funds, with Mandiant identifying the attacker as the North Korean threat group UNC6862.The stolen funds were subsequently bridged to Ethereum, with approximately 130,300 ETH distributed across 4 wallets. Three of these wallets have seen no transfers to date, collectively holding 107,200 ETH; the other wallet transferred approximately 23,100 ETH to Tornado Cash on July 23.Currently, approximately $9.2 million in stolen funds has been frozen. The relevant funds had previously been transferred through Tornado Cash in August, and unfreezing and return still require cooperation with legal procedures. The Drift Foundation will transfer all assets recovered through freezing, bounties, or law enforcement channels into the DFX recovery pool, and is evaluating the subsequent path of the DRIFT token within the broader ecosystem. In addition, the foundation has partnered with Bybit to launch a public bounty program, offering a 10% bounty on successfully recovered funds.
Non-custodial developer criminal liability explicit protection removed, Coin Center says Roman Storm prosecution theory still not excluded
Bitcoin News posted on X platform stating that Coin Center says the latest revised BRCA text removes the provision that provided explicit criminal liability protection for developers who do not control user funds under 18 U.S.C. § 1960. The revised text would still protect developers who do not control user funds from being deemed money transmitters under the Bank Secrecy Act and FinCEN regulations, thereby significantly raising the difficulty of prosecuting developers solely for failing to obtain a money transmitter license or register with the federal government. However, the text cannot prevent prosecutors from arguing that developers knowingly transmitted funds derived from criminal activity, a theory that has become the core basis in the criminal cases against Tornado Cash developer Roman Storm and Samourai Wallet developers. Coin Center believes that this compromise represents substantive progress on the regulatory front, but developers still face broader money transmission criminal prosecution theories from the U.S. Department of Justice; if the CLARITY Act passes with the revised BRCA, the related disputes will mainly shift to the courts.
Binance hacker transfers $38.82 million ETH to new wallet, still holds $1.12 billion in ETH
According to Arkham's monitoring, Binance hackers just transferred $38.82 million worth of ETH to a new wallet, possibly preparing to deposit it into Tornado Cash. The wallet still holds $1.12 billion in ETH.
Stolen BTC Short-Term Selling Pressure Nearly Zero, Benson Sun Says ETH More Likely to Form Selling Pressure
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
EIP-7702 authorization exploited to move Binance wallet assets, with an additional $780M USDC transferred out
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
Market News: Over $2.5 Billion in Assets Reportedly Stolen from Binance Hot Wallet
According to on-chain reports, abnormal fund outflows have occurred from Binance's hot wallet, with funds flowing to newly created addresses. These addresses were initially funded via Tornado Cash, and the stolen funds are valued at over $2.5 billion.
Predict Fun on BSC Suspected of Being Attacked, Approximately $300,000 in Funds Flows Into Tornado Cash
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun was allegedly compromised via a vulnerability, with approximately $300,000 in suspected stolen funds transferred from multiple contracts through intermediary wallets to Relay. These funds were reportedly routed into Tornado Cash following a cross-chain transfer.
A user's private key is suspected to have been leaked, with approximately $1.58 million in assets stolen.
According to monitoring by Scam Sniffer, a user's assets on the Ethereum and Base networks were reportedly stolen due to a leaked private key, resulting in losses of approximately $1.58 million. The attacker drained 682 ETH in under two hours, with approximately 281 ETH subsequently transferred to Tornado Cash.
Binance hacker transfers $38.82 million ETH to new wallet, still holds $1.12 billion in ETH
According to Arkham's monitoring, Binance hackers just transferred $38.82 million worth of ETH to a new wallet, possibly preparing to deposit it into Tornado Cash. The wallet still holds $1.12 billion in ETH.
Stolen BTC Short-Term Selling Pressure Nearly Zero, Benson Sun Says ETH More Likely to Form Selling Pressure
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
EIP-7702 authorization exploited to move Binance wallet assets, with an additional $780M USDC transferred out
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
Market News: Over $2.5 Billion in Assets Reportedly Stolen from Binance Hot Wallet
According to on-chain reports, abnormal fund outflows have occurred from Binance's hot wallet, with funds flowing to newly created addresses. These addresses were initially funded via Tornado Cash, and the stolen funds are valued at over $2.5 billion.
Hifi Finance Suffers Governance Takeover by DAO, Approximately $1 Million in User Collateral Drained
According to on-chain researcher Spreek, DeFi protocol Hifi Finance suffered a DAO governance takeover. The attacker gained control through four last-minute votes funded by Tornado Cash, subsequently minted 25 million governance tokens, and drained user collateral assets worth approximately $1 million, most of which were RWA tokens.
Predict Fun on BSC Suspected of Being Attacked, Approximately $300,000 in Funds Flows Into Tornado Cash
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun was allegedly compromised via a vulnerability, with approximately $300,000 in suspected stolen funds transferred from multiple contracts through intermediary wallets to Relay. These funds were reportedly routed into Tornado Cash following a cross-chain transfer.
Ethereum Researchers Propose New Privacy Pool Solution: Supports Post-Quantum Resistance and Recursive Aggregation, Significantly Boosting Proof Generation Speed
Ethereum Research Forum researcher Pierre proposes a faster, aggregatable, and quantum-resistant privacy pool scheme. The scheme ports a Tornado Cash-like privacy pool onto the hash-based SNARK system Flock, which may offer post-quantum security, and adopts SHA-256. It replaces large circuits with small “single-pass” compression circuits.
US Prosecutors Cite Bitcoin Fog Precedent to Support Trying Tornado Cash Defendant Roman Storm in New York
Odaily News: Bitcoin News posted on X platform that U.S. federal prosecutors informed Judge Katherine Polk Failla that the U.S. Court of Appeals for the D.C. Circuit upheld the conviction of Bitcoin Fog founder Roman Sterlingov on September 25, supporting the trial of Tornado Cash defendant Roman Storm in New York. The appellate court determined that Washington, D.C. has trial jurisdiction, reasoning that law enforcement officers had deposited approximately $250 worth of Bitcoin into Bitcoin Fog from Washington, D.C. Prosecutors argued that since user Shakeeb Ahmed accessed Tornado Cash from his apartment in Manhattan, the same logic applies. Roman Storm released this letter and noted that FinCEN withdrew its 2023 mixer reporting requirement on the same day, citing concerns that the proposal could suppress legitimate activity.
US DOJ Cites Bitcoin Fog Precedent to Oppose Roman Storm's Acquittal Motion
Odaily reports: The U.S. Department of Justice (DOJ), in a filing submitted on Monday, cited the appellate ruling in the case of Roman Sterlingov, the operator of cryptocurrency mixer Bitcoin Fog, as supplementary grounds for opposing Tornado Cash developer Roman Storm's acquittal motion.U.S. prosecutors stated that the ruling supports their position that the Southern District of New York is the proper venue for the trial. Prosecutors argued that Shakeeb Ahmed used Tornado Cash in a Manhattan apartment, and that this activity is sufficient to establish venue for the money laundering and unlicensed money transmission conspiracy charges against Roman Storm.Judge Katherine Polk Failla heard arguments on Roman Storm's acquittal motion in April 2026 but has not yet issued a ruling. A jury in August 2025 convicted him of conspiracy to operate an unlicensed money transmitting business, but failed to reach a unanimous verdict on the money laundering and sanctions conspiracy charges, with a retrial tentatively scheduled for April 26, 2027. (Cointelegraph)
Loss of approximately $538,000: A dormant MakerDAO liquidation bot proxy was drained of 200 WETH
a new address funded via Tornado Cash extracted 200 WETH on October 6 from a dormant MakerDAO ETH-A liquidation bot proxy, causing losses of approximately $538,000. The upgradeable proxy had won 4 ETH-A liquidation auctions in 2020, namely auctions #1457 through #1460, earning 50 WETH each, but never called deal(), leaving the collateral stuck in the Flipper. The implementation contract's exit function was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the aforementioned old auctions, then transferring the collateral to the keeper via Vat.flux, and subsequently calling GemJoin.exit to send the 200 WETH to a caller-specified address and unwrap it into ETH. The MakerDAO core contracts operated as designed; the vulnerability lies in the third-party bot's exit function lacking access controls.
JaredfromSubway.eth sandwich attack bot has extracted $295 million in total, with $7.5 million stolen in June
Odaily News: The sandwich attack bot operated by JaredfromSubway.eth has extracted a cumulative total of 117,007 ETH since March 2023, worth approximately $295 million at current prices. In June 2026, an anonymous attacker deployed 66 counterfeit token contracts, exploiting the bot's automated trading logic to steal at least $7.5 million in ETH and stablecoins, and funneled the funds into Tornado Cash. The stolen assets have not yet been recovered.Sandwich attacks are a form of Maximal Extractable Value (MEV): the bot monitors large transactions in Ethereum's public mempool, buys ahead of the target transaction, and sells after the transaction pushes the price up, capturing profits from the spread. The bot's primary contract had received a cumulative total of 117,007 ETH as of August 28.MEV-Boost block construction is centralized among a small group of participants, with relay.ultrasound.money, Titan Relay, and bloXroute regulated relays collectively forwarding approximately 85% to 88% of related blocks within a 24-hour window; Titan's builder independently assembled 50.3% of the blocks. Monthly sandwich attack extraction amounts have declined from approximately $10 million in late 2024 to roughly $2.5 million in October 2025. (Bitcoin.com News)
Donald Trump earned over $1.4 billion from crypto businesses in 2025, while CLARITY Act identified with five major flaws
Odaily News: On August 5, the minority staff of the U.S. Senate Committee on Banking, Housing, and Urban Affairs stated that the July 22 version of the CLARITY Act fails to meet five minimum standards. The bill, numbered H.R. 3633, aims to divide digital asset regulatory authority between the U.S. Securities and Exchange Commission (SEC) and the U.S. Commodity Futures Trading Commission (CFTC). The analysis suggests that the bill's two-tier system could remove certain blockchain assets from SEC oversight, allowing issuing companies to self-certify exemptions from securities regulation. Healthy Markets and five labor organizations have raised concerns over pension protections and securities law loopholes, while minority staff also noted that investors' private right of action and state and tribal enforcement powers could be weakened. Minority staff stated that DeFi-related companies could be exempt from anti-illegal financing obligations even if they earn millions of dollars from platform transactions; some crypto mixers may circumvent U.S. sanctions by exploiting the "Tornado Cash loophole." The Independent Community Bankers of America (ICBA) and the Conference of State Bank Supervisors (CSBS) warned that stablecoin yields could drain deposits from community banks, and the Systemic Risk Council has flagged related banking activities as potential bailout risks. Minority staff noted that Donald Trump alone earned over $1.4 billion from crypto businesses in 2025, with related enforcement solely under the purview of his Attorney General, and that obligations would terminate upon his departure from office. Elizabeth Warren and Richard Blumenthal, citing $3.8 billion in investor losses, have separately called on the SEC to investigate Trump memecoin. The Senate is scheduled to hold a cloture vote on September 15 on the motion to proceed, with the bill needing 60 votes to advance. (Bitcoin.com News)
Related news
Binance hacker transfers $38.82 million ETH to new wallet, still holds $1.12 billion in ETH
According to Arkham's monitoring, Binance hackers just transferred $38.82 million worth of ETH to a new wallet, possibly preparing to deposit it into Tornado Cash. The wallet still holds $1.12 billion in ETH.
Stolen BTC Short-Term Selling Pressure Nearly Zero, Benson Sun Says ETH More Likely to Form Selling Pressure
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
EIP-7702 authorization exploited to move Binance wallet assets, with an additional $780M USDC transferred out
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
Market News: Over $2.5 Billion in Assets Reportedly Stolen from Binance Hot Wallet
According to on-chain reports, abnormal fund outflows have occurred from Binance's hot wallet, with funds flowing to newly created addresses. These addresses were initially funded via Tornado Cash, and the stolen funds are valued at over $2.5 billion.
Hifi Finance Suffers Governance Takeover by DAO, Approximately $1 Million in User Collateral Drained
According to on-chain researcher Spreek, DeFi protocol Hifi Finance suffered a DAO governance takeover. The attacker gained control through four last-minute votes funded by Tornado Cash, subsequently minted 25 million governance tokens, and drained user collateral assets worth approximately $1 million, most of which were RWA tokens.
Predict Fun on BSC Suspected of Being Attacked, Approximately $300,000 in Funds Flows Into Tornado Cash
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun was allegedly compromised via a vulnerability, with approximately $300,000 in suspected stolen funds transferred from multiple contracts through intermediary wallets to Relay. These funds were reportedly routed into Tornado Cash following a cross-chain transfer.