News linked to both this project and an event.
According to Arkham's monitoring, Binance hackers just transferred $38.82 million worth of ETH to a new wallet, possibly preparing to deposit it into Tornado Cash. The wallet still holds $1.12 billion in ETH.
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
According to on-chain reports, abnormal fund outflows have occurred from Binance's hot wallet, with funds flowing to newly created addresses. These addresses were initially funded via Tornado Cash, and the stolen funds are valued at over $2.5 billion.
According to on-chain researcher Spreek, DeFi protocol Hifi Finance suffered a DAO governance takeover. The attacker gained control through four last-minute votes funded by Tornado Cash, subsequently minted 25 million governance tokens, and drained user collateral assets worth approximately $1 million, most of which were RWA tokens.
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun was allegedly compromised via a vulnerability, with approximately $300,000 in suspected stolen funds transferred from multiple contracts through intermediary wallets to Relay. These funds were reportedly routed into Tornado Cash following a cross-chain transfer.
According to monitoring by Scam Sniffer, a user's assets on the Ethereum and Base networks were reportedly stolen due to a leaked private key, resulting in losses of approximately $1.58 million. The attacker drained 682 ETH in under two hours, with approximately 281 ETH subsequently transferred to Tornado Cash.
据 Spreek 监测表示，Initia 链遭遇攻击，多个代币出现“无限增发”情况。攻击者目前已套现约 260 万美元，另有部分资金仍在转移过程中。攻击者以太坊地址（0xDD9 开头）目前持有约 1102 枚 ETH，价值约 265 万美元，该地址初始资金来自 Tornado Cash。此外，攻击者在 Initia 链上的地址仍持有约 454 万美元资产，包括 300 万枚 iUSD、92 万枚 USDC、40 万枚 AUSD 及 95 枚 ETH。目前 Initia 官方尚未回应。
On-chain analyst PeckShield (@PeckShieldAlert) has tracked an address flagged as the Cysic attacker depositing 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash. According to the Cysic Foundation, a security incident involving the Cysic cross-chain bridge occurred on October 17, during which the attacker minted 10 million CYS tokens without authorization on the BNB Chain.
According to Lookonchain monitoring, the Drift Protocol attacker who stole over $270 million has once again deposited 24,885 ETH, worth $61.3 million, into Tornado Cash, and currently still holds 56,569 ETH, worth $139.3 million.
According to monitoring by PeckShieldAlert, the address labeled as Drift Exploiter 1 is depositing a new batch of stolen funds into Tornado Cash. To date, it has cumulatively transferred in approximately 18,800 ETH, worth around $46 million.
According to on-chain investigator ZachXBT (@zachxbt), an institutional entity was reportedly targeted by a DPRK-linked group, SquidSquad, on BSC on October 8, with approximately $2.84 million stolen. On October 20, the attacker deposited 1111.2 ETH into Tornado Cash and withdrew the funds to three addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b, 0x35c72e26f6888b4cba8668c6cfa4143599680bfe, and 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848. Subsequently, the funds were bridged cross-chain via USDT0 from Ethereum to Tron and consolidated into TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux. Both consolidation addresses are linked to previously identified DPRK-affiliated addresses.
According to Onchain Lens monitoring, the Drift Protocol attacker has become active again after 2 months, sending at least 13,400 ETH worth approximately $32 million to Tornado Cash, possibly to obscure the fund trail. The attacker still holds $225 million in assets across tracked wallets, including 93,965 ETH worth $224 million; 477,375 USDY worth approximately $549,000; and 1.33 SOL worth $138.
The Aztec Rollup attacker deposited 1,255.8 ETH, worth approximately $3 million, into Tornado Cash.
Odaily News: According to Bitcoin News monitoring, the attacker behind the Ledger supply chain theft has moved nearly 3,000 ETH through Tornado Cash in three separate transactions, and transferred the funds into the Zcash privacy pool before converting them to USDC. Investigator @YFarmX stated that despite the use of privacy tools, they have traced 108 transactions completed through Zcash by exact value matching. An estimated $2.85 million in stolen USDC is still held in 3 wallets, and Circle may be able to freeze the related funds. Meanwhile, Tether is reported to have frozen $10 million in stolen USDT; wallets associated with the attacker still hold approximately $38.6 million in ETH and $16.9 million in BTC.
据 Salus 监测，加密支付服务商 Triple-A 的攻击者已将 4,970 枚 ETH（价值约 1,240 万美元）转入混合清算工具 Tornado Cash。今年 7 月，该攻击者盗取了 Triple-A 自身财库的资产，公开估计损失约为 1,180 万美元。在将资金跨链桥接至以太坊网络并完成代币兑换后，攻击者于 9 月 6 日将资金分散至两个中间地址。10 月 9 日，攻击者通过单一钱包整合两笔资金流，并分批充值至 Tornado Cash，其中包括 49 笔 100 ETH 和 7 笔 10 ETH 的交易，其中部分资金来源于此前从混币器提取的款项。
according to on-chain analyst Yu Jin's monitoring, an address received 263 ETH from Tornado Cash yesterday, then swapped it for approximately 643,000 USDC and deposited it into Hyperliquid.The address opened a 40x leveraged cross-margin short position on 305.5 BTC, with a position size of approximately $25.38 million, an average entry price of $83,068, and a liquidation price of $84,088. The current unrealized profit is about $160,000. The source of the address's funds involves Tornado Cash, but it cannot yet be confirmed whether it is related to hacker activity.
According to on-chain analyst Onchain Lens (@OnchainLens), the hacker associated with the $90 million Ledger reseller incident has cumulatively deposited approximately $270,300 into Binance, including 256.57K USDT and 41.12K TRX (about $13,700), with the majority of funds already transferred to Binance's hot wallet. Previously, the hacker also used four wallets to deposit 430.2 ETH (approximately $1.07 million) into Tornado Cash for mixing, and converted USDT to USDD to evade Tether's fund freeze.
According to monitoring by Galaxy's head of research, in the Ledger CryptoBillis attack incident, approximately $72.9 million remains in addresses controlled by the attacker, involving Bitcoin, Ethereum, and USDT; $3.1 million entered Tornado Cash, while the remaining funds have been bridged across chains, swapped, or layered and transferred through relayers.
According to Onchain Lens monitoring, the suspected hacker behind the reported $90 million Ledger reseller incident has deposited 430.2 ETH, worth $1.07 million, into Tornado Cash through 4 wallets. After Tether froze the related funds, the hacker swapped USDT for USDD through SUN.io and USDD's PSM, with some funds also flowing into Binance hot wallets.The hacker's wallet tracked by Arkham currently holds a total of $70.6 million in assets, including 11,406 ETH worth $28.35 million; 213.371 BTC worth $17.65 million; 13.646 million USDD worth $13.65 million; and 10.909 million USDT worth $10.91 million. Onchain Lens is calling on Binance to investigate these transfers and freeze accounts associated with the stolen funds as soon as possible.