#tornadocash
tornadocash
254,974 views
327 Discussing
Hot
Latest
📊 Sanctioned so hard they can’t even renew a domain, Tornado Cash users were phished for $2.3 million
Tornado Cash, that mixer sanctioned by OFAC. After the sanctions, the official domain expired, the team couldn’t renew it, and it was immediately hijacked by someone else.
On August 20, a user clicked an old browser bookmark saved for years and landed on a fake tornado.cash. The page looked identical; the user continued depositing, while the attacker secretly captured the private note needed to withdraw.
1,010 ETH were gone—about $2.3 million at current prices. One user. One click.
This isn’t an isolated case. Over the past 12 months, phishing scams using similar expired domains have collectively siphoned off nearly 4,000 ETH.
Following the money on-chain, it was first converted to BTC, sent through Whirlpool for a round of mixing, and then returned to Ethereum and Tornado Cash. The mixer’s users were laundered through the mixer.
Sanctions were meant to choke off the protocol. The protocol didn’t die—ordinary people who used it paid the price first. The team couldn’t even keep the ability to maintain its own website, and the blame was dumped entirely on retail users.
$BTC
#中本聪国际社区Baoluo币商资本 #Bitcoin #TornadoCash
Tornado Cash, that mixer sanctioned by OFAC. After the sanctions, the official domain expired, the team couldn’t renew it, and it was immediately hijacked by someone else.
On August 20, a user clicked an old browser bookmark saved for years and landed on a fake tornado.cash. The page looked identical; the user continued depositing, while the attacker secretly captured the private note needed to withdraw.
1,010 ETH were gone—about $2.3 million at current prices. One user. One click.
This isn’t an isolated case. Over the past 12 months, phishing scams using similar expired domains have collectively siphoned off nearly 4,000 ETH.
Following the money on-chain, it was first converted to BTC, sent through Whirlpool for a round of mixing, and then returned to Ethereum and Tornado Cash. The mixer’s users were laundered through the mixer.
Sanctions were meant to choke off the protocol. The protocol didn’t die—ordinary people who used it paid the price first. The team couldn’t even keep the ability to maintain its own website, and the blame was dumped entirely on retail users.
$BTC
#中本聪国际社区Baoluo币商资本 #Bitcoin #TornadoCash
Verified
Tornado Cash founder: The U.S. Department of Justice has enforcement logic flaws, and the blame points directly at Google and OpenAI
Recently, Tornado Cash founder Roman Storm publicly accused the U.S. Department of Justice of having logical flaws in its case, and said that under the same prosecution standards, Google and OpenAI should also be held responsible for their products being misused by North Korean IT workers.
Storm cited a recent investigation on social media platform X, stating that North Korean IT workers continue to use ChatGPT for writing and coding, and also use Google Gemini to forge and tamper with images.
According to data from the U.S. Treasury Department, in 2024, North Korea’s nuclear weapons program spending was about $800 million, and most of this funding came from wage income earned by North Korean IT workers.
If the DOJ’s logic in the Tornado Cash case—holding developers accountable for illicit use—is applied, then these two tech giants, Google and OpenAI, should also be responsible for the illegal activities of North Korean IT workers, because they provide services and profit from subscriptions.
In August 2025, Storm was convicted for conspiracy to operate an unlicensed remittance business. The ruling also set a legal precedent that software developers may be held liable for code that is used for illegal purposes.
In Storm’s view, writing code is essentially a technical creation activity and is not inherently unlawful. He also stressed that the law should hold the criminals responsible, not the tool makers, because writing code itself does not constitute a crime.
Storm concluded with a sarcastic remark: if the DOJ can keep its enforcement logic consistent, it should subpoena every employee at Google and OpenAI, examine whether they knew their tools were being used by North Korean IT workers, and sue them under the International Emergency Economic Powers Act.
What do you think? Do you believe Storm’s accusations against Google and OpenAI hold up? Should software developers also be held accountable for users’ wrongdoing? Leave your thoughts in the comments!
#TornadoCash
Recently, Tornado Cash founder Roman Storm publicly accused the U.S. Department of Justice of having logical flaws in its case, and said that under the same prosecution standards, Google and OpenAI should also be held responsible for their products being misused by North Korean IT workers.
Storm cited a recent investigation on social media platform X, stating that North Korean IT workers continue to use ChatGPT for writing and coding, and also use Google Gemini to forge and tamper with images.
According to data from the U.S. Treasury Department, in 2024, North Korea’s nuclear weapons program spending was about $800 million, and most of this funding came from wage income earned by North Korean IT workers.
If the DOJ’s logic in the Tornado Cash case—holding developers accountable for illicit use—is applied, then these two tech giants, Google and OpenAI, should also be responsible for the illegal activities of North Korean IT workers, because they provide services and profit from subscriptions.
In August 2025, Storm was convicted for conspiracy to operate an unlicensed remittance business. The ruling also set a legal precedent that software developers may be held liable for code that is used for illegal purposes.
In Storm’s view, writing code is essentially a technical creation activity and is not inherently unlawful. He also stressed that the law should hold the criminals responsible, not the tool makers, because writing code itself does not constitute a crime.
Storm concluded with a sarcastic remark: if the DOJ can keep its enforcement logic consistent, it should subpoena every employee at Google and OpenAI, examine whether they knew their tools were being used by North Korean IT workers, and sue them under the International Emergency Economic Powers Act.
What do you think? Do you believe Storm’s accusations against Google and OpenAI hold up? Should software developers also be held accountable for users’ wrongdoing? Leave your thoughts in the comments!
#TornadoCash
ALERT 🚨 Order blocks on $TORN (TORNADO CASH) signal bullish momentum as liquidity expands. $AR (ARWEAVE) showcases ecosystem growth, new data storage contracts driving adoption. $AUCTION (AUCTION) sees strong trading activity, reflecting investor confidence. Strong buy on all three as innovation, volume and sentiment converge. #TornadoCash #Arweave #Auction
$ETH JUST SAW A $10.5M BUY AT 1,757 – BUT THE SELLER USED TORNADO CASH 🧐
Someone moved $10.54M to buy 6,001 ETH at exactly $1,757 per coin, then mixed it through Tornado Cash. That’s a massive bid at a level that’s been a key zone on the monthly.
Whales don’t dump into privacy mixers unless they plan to exit quietly. The question is whether this was accumulation or a liquidation cover before a bigger move.
Does a coordinated buy at this level make you want to take a position, or does the mixer use scare you off?
Not financial advice. Always manage your risk.
#ETH #WhaleAlert #TornadoCash #CryptoMarket
💎
Someone moved $10.54M to buy 6,001 ETH at exactly $1,757 per coin, then mixed it through Tornado Cash. That’s a massive bid at a level that’s been a key zone on the monthly.
Whales don’t dump into privacy mixers unless they plan to exit quietly. The question is whether this was accumulation or a liquidation cover before a bigger move.
Does a coordinated buy at this level make you want to take a position, or does the mixer use scare you off?
Not financial advice. Always manage your risk.
#ETH #WhaleAlert #TornadoCash #CryptoMarket
💎
The UXLINK attacker is going on a mad money-laundering spree, buying $6.5 million worth of ETH in 30 minutes and 'disappearing' through Tornado Cash.
On-chain monitoring shows that the UXLINK attacker is ramping up their laundering activities.
Latest move: In the past 30 minutes, this attacker spent 6.5 million DAI, averaging $1,764 to scoop up 3,686 ETH, then washed the funds through Tornado Cash.
This isn't their first rodeo. Previously, the attacker swapped 92 WBTC for about 3,248 ETH and deposited 1,500 ETH into Tornado Cash. On September 22, the UXLINK multi-signature wallet suffered a loss exceeding $44 million due to a security breach.
What does this mean?
Buying $6.5 million in ETH and funneling it into a mixer is a textbook on-chain money laundering procedure. This level of capital means that the ETH market will face ongoing sell pressure in the short term—not from regular traders, but from the cash-out demands of hackers.
Tornado Cash is a privacy mixer, and once the funds go in, they are practically untraceable. The hacker's choice of this method indicates they don’t plan to leave any traces of this money on-chain.
Market impact: The UXLINK attacker is still active, and more ETH could be dumped in the future. Day traders should be wary of the potential sell pressure on ETH. On-chain tracking shows that this attacker still holds a significant amount of DAI and ETH.
#UXLINK #hacker #moneylaundering #ETH #TornadoCash #链上追踪
On-chain monitoring shows that the UXLINK attacker is ramping up their laundering activities.
Latest move: In the past 30 minutes, this attacker spent 6.5 million DAI, averaging $1,764 to scoop up 3,686 ETH, then washed the funds through Tornado Cash.
This isn't their first rodeo. Previously, the attacker swapped 92 WBTC for about 3,248 ETH and deposited 1,500 ETH into Tornado Cash. On September 22, the UXLINK multi-signature wallet suffered a loss exceeding $44 million due to a security breach.
What does this mean?
Buying $6.5 million in ETH and funneling it into a mixer is a textbook on-chain money laundering procedure. This level of capital means that the ETH market will face ongoing sell pressure in the short term—not from regular traders, but from the cash-out demands of hackers.
Tornado Cash is a privacy mixer, and once the funds go in, they are practically untraceable. The hacker's choice of this method indicates they don’t plan to leave any traces of this money on-chain.
Market impact: The UXLINK attacker is still active, and more ETH could be dumped in the future. Day traders should be wary of the potential sell pressure on ETH. On-chain tracking shows that this attacker still holds a significant amount of DAI and ETH.
#UXLINK #hacker #moneylaundering #ETH #TornadoCash #链上追踪
After the Step Finance hacker went quiet for 5 months, they suddenly acted—fully liquidating all 261,900 SOL they held, cashing out about $21.4 million.
On-chain sleuth Lookonchain traced that the funds were then bridged to Ethereum, converted into 12,128 ETH, and then dumped all at once into Tornado Cash to launder the proceeds.
A few details are worth paying attention to:
1) They chose to sell off SOL while it was relatively high, suggesting the timing was not amateurish;
2) The route—swapping from Solana to ETH and then going through a mixer—follows the standard playbook of seasoned hackers;
3) The longer the inactivity period, the more decisive the move once it happens—addresses like this will very likely carry out a second wave and third wave of liquidation later on.
For ordinary holders, there are two things to watch in the short term: first, the SOL spot market now has an additional sell-pressure source at the scale of several tens of millions of dollars; second, the ETH side is now burdened with a batch of mixer-originated funds that need to be absorbed. Money entering a mixer usually doesn’t immediately return to a CEX, but for exchange compliance teams, deposit screening in the coming weeks will likely be tighter.
Clearing the hacker’s balance doesn’t mean the story ends—it just marks the point where the funds start moving into a much harder-to-trace phase.
#StepFinance #Hack #TornadoCash
$SOL $ETH
On-chain sleuth Lookonchain traced that the funds were then bridged to Ethereum, converted into 12,128 ETH, and then dumped all at once into Tornado Cash to launder the proceeds.
A few details are worth paying attention to:
1) They chose to sell off SOL while it was relatively high, suggesting the timing was not amateurish;
2) The route—swapping from Solana to ETH and then going through a mixer—follows the standard playbook of seasoned hackers;
3) The longer the inactivity period, the more decisive the move once it happens—addresses like this will very likely carry out a second wave and third wave of liquidation later on.
For ordinary holders, there are two things to watch in the short term: first, the SOL spot market now has an additional sell-pressure source at the scale of several tens of millions of dollars; second, the ETH side is now burdened with a batch of mixer-originated funds that need to be absorbed. Money entering a mixer usually doesn’t immediately return to a CEX, but for exchange compliance teams, deposit screening in the coming weeks will likely be tighter.
Clearing the hacker’s balance doesn’t mean the story ends—it just marks the point where the funds start moving into a much harder-to-trace phase.
#StepFinance #Hack #TornadoCash
$SOL $ETH
ALERT 🚨 $SENT (SENTINEL PROTOCOL) is carving a bullish path as order blocks near the $SENT 200 day level. $TORN (TORNADO CASH) shows strong volume momentum, signaling renewed privacy demand. $WTC (WHITECOIN) sees ecosystem growth with new DeFi integrations, boosting liquidity and investor sentiment. Together they form a diversified, high potential portfolio for traders seeking innovation. #SentinelProtocol #TornadoCash #Whitecoin #CryptoTrading
The group behind the security incident at Coldcard has just carried out the transfer of assets while moving 64 $BTC and 200 $ETH through the Wasabi and Tornado Cash mixing tools in order to erase traces of the money flow.
#Coldcard #TornadoCash
$AVAX
#Coldcard #TornadoCash
$AVAX
The group behind the security incident at Coldcard has just carried out the disposal of assets while moving 64 $BTC and 200 $ETH through money-mixing tools Wasabi and Tornado Cash in order to erase traces of the money flow.
#Coldcard #TornadoCash
$AVAX
#Coldcard #TornadoCash
$AVAX
ALERT 🚨 Strong bullish signals on ZeroK ( $ZK ), Tornado Cash ( $TORN ), and Test ( $TST ). Order blocks are forming on $ZK with high volume and momentum. $TORN’s ecosystem growth fuels investor sentiment, while $TST ’s liquidity surge signals potential breakout. Innovate and seize opportunities. #ZeroK #TornadoCash #Test
Explorer #UXLİNK is stacking $ETH by washing funds through #TornadoCash .
In the last 30 minutes, explorer #uxlink has shelled out 6.5 million DAI to scoop up 3,686 $ETH at an average price of $1.764.
#Whale.Alert #SECChairAtkinsReformsIPOAccess
In the last 30 minutes, explorer #uxlink has shelled out 6.5 million DAI to scoop up 3,686 $ETH at an average price of $1.764.
#Whale.Alert #SECChairAtkinsReformsIPOAccess
Jaredfromsubway's attacker funneled 2000 ETH via Tornado Cash and has already shorted 1422 ETH. #ETH #TornadoCash #Jaredfromsubway
After 5 months of silence, the Step Finance hacker suddenly struck—dumping all 261,933 SOL (about $21.4 million) they held, cross-chained to Ethereum to convert it into 12,128 ETH, and then shoved it all into Tornado Cash to launder it.
This kind of operational path is basically a “textbook” old playbook: SOL liquidation → bridge to ETH → use a mixer. Choosing this moment to act likely reflects a belief that on-chain tracking attention has cooled off, or that ETH liquidity and mixer depth are more suitable for getting away.
Points worth noting:
1) The selling impact. A concentrated sell-off of 260,000+ SOL, combined with exchanging via a bridge into ETH, would likely create short-term selling pressure on $SOL and also leave clear traces at the cross-chain bridge.
2) Tornado Cash is still the hacker’s go-to option, suggesting that regulatory and compliance pressure hasn’t truly cut off its usability. The privacy channels in the $ETH ecosystem remain an exit route for illicit actors.
3) The “silence—then concentrated liquidation” timing is something to watch closely, including other previously compromised addresses. Many older wallets may gradually get unfrozen.
For ordinary users, this kind of news is not a market signal—it’s a reminder: on-chain activity is not truly anonymous; it’s only “delayed disclosure,” and hackers can’t outrun time.
#SOL #TornadoCash #On-chain tracking
This kind of operational path is basically a “textbook” old playbook: SOL liquidation → bridge to ETH → use a mixer. Choosing this moment to act likely reflects a belief that on-chain tracking attention has cooled off, or that ETH liquidity and mixer depth are more suitable for getting away.
Points worth noting:
1) The selling impact. A concentrated sell-off of 260,000+ SOL, combined with exchanging via a bridge into ETH, would likely create short-term selling pressure on $SOL and also leave clear traces at the cross-chain bridge.
2) Tornado Cash is still the hacker’s go-to option, suggesting that regulatory and compliance pressure hasn’t truly cut off its usability. The privacy channels in the $ETH ecosystem remain an exit route for illicit actors.
3) The “silence—then concentrated liquidation” timing is something to watch closely, including other previously compromised addresses. Many older wallets may gradually get unfrozen.
For ordinary users, this kind of news is not a market signal—it’s a reminder: on-chain activity is not truly anonymous; it’s only “delayed disclosure,” and hackers can’t outrun time.
#SOL #TornadoCash #On-chain tracking
HACK ALERT
A major exploit has reportedly drained approximately $1.1 million from the LABUBU ecosystem.
According to on-chain investigators, the attacker exploited a vulnerability linked to the OLPC contract’s _update function, where decimalsValue had been set to an abnormally large number (reportedly over 7.3 quintillion) around 46 days earlier.
This manipulation allowed the attacker to use a relatively small amount of OLPC to extract a large portion of LABUBU and other assets from the liquidity pool.
📊 Key Details:
🔹 Estimated loss: ~$1.1M
🔹 Funds swapped into USDT
🔹 Bridged to Ethereum
🔹 633 ETH sent to Tornado Cash
🔹 Ownership was later renounced to the zero address
The incident highlights once again how hidden contract risks and privileged parameter changes can remain unnoticed for weeks before being exploited.
⚠️ Always review contract permissions and ownership structures before investing in newly launched tokens.
#Hack #LABUBU #TornadoCash
A major exploit has reportedly drained approximately $1.1 million from the LABUBU ecosystem.
According to on-chain investigators, the attacker exploited a vulnerability linked to the OLPC contract’s _update function, where decimalsValue had been set to an abnormally large number (reportedly over 7.3 quintillion) around 46 days earlier.
This manipulation allowed the attacker to use a relatively small amount of OLPC to extract a large portion of LABUBU and other assets from the liquidity pool.
📊 Key Details:
🔹 Estimated loss: ~$1.1M
🔹 Funds swapped into USDT
🔹 Bridged to Ethereum
🔹 633 ETH sent to Tornado Cash
🔹 Ownership was later renounced to the zero address
The incident highlights once again how hidden contract risks and privileged parameter changes can remain unnoticed for weeks before being exploited.
⚠️ Always review contract permissions and ownership structures before investing in newly launched tokens.
#Hack #LABUBU #TornadoCash
Stayed silent for 5 months, and then a Step Finance hacker suddenly went on the offensive.
On-chain sleuth Lookonchain has detected that the address dumped all 261,933 $SOL at once, cashing out about $21.4 million, then bridged over to Ethereum to convert it into 12,128 $ETH and directly sent it into Tornado Cash for mixing.
A few signals are worth noting:
· A long-dormant address waking up often corresponds to a short-term release of sell pressure, so keep an eye on the SOL spot order book for any lingering wave from large dumps;
· Choosing the route "sell SOL → swap to ETH → enter TC" suggests the hacker trusts the mixing depth on the Ethereum side more than staying within the Solana ecosystem;
· Tornado Cash, which has been sanctioned for years, is still the preferred exit—on-chain tracing can help identify where funds go, but once money is pooled there, recovery becomes dramatically harder.
For ordinary users, this kind of news is a mirror—review your authorization management, cold-wallet tiering, and habits when using cross-chain bridges. The hacker’s patience is longer than most people would expect.
#Solana #链上安全 #TornadoCash
On-chain sleuth Lookonchain has detected that the address dumped all 261,933 $SOL at once, cashing out about $21.4 million, then bridged over to Ethereum to convert it into 12,128 $ETH and directly sent it into Tornado Cash for mixing.
A few signals are worth noting:
· A long-dormant address waking up often corresponds to a short-term release of sell pressure, so keep an eye on the SOL spot order book for any lingering wave from large dumps;
· Choosing the route "sell SOL → swap to ETH → enter TC" suggests the hacker trusts the mixing depth on the Ethereum side more than staying within the Solana ecosystem;
· Tornado Cash, which has been sanctioned for years, is still the preferred exit—on-chain tracing can help identify where funds go, but once money is pooled there, recovery becomes dramatically harder.
For ordinary users, this kind of news is a mirror—review your authorization management, cold-wallet tiering, and habits when using cross-chain bridges. The hacker’s patience is longer than most people would expect.
#Solana #链上安全 #TornadoCash
After the Step Finance hacker went quiet for five months, they suddenly struck: they liquidated all 261,933 SOL (about $21.4 million) at once, wiping the holdings. Immediately after, they bridged to Ethereum, exchanged it for 12,128 ETH, and then dumped it all into Tornado Cash to launder it.
A few details are worth watching:
1) The tempo — not a slow, incremental selloff, but a one-stop sequence: sell, bridge, then mix. This clearly bets on the market’s ability to absorb the sell pressure and on the timing gap for on-chain tracing;
2) The route — SOL → ETH → Tornado. It’s almost a textbook move from an old wallet, suggesting that hackers of this type still lack confidence in draining funds from the Solana ecosystem and ultimately return to Ethereum for the final stage of laundering;
3) The timing — acting after such a long period of silence often means they believe the news cycle has cooled and monitoring has relaxed. This is also the moment when on-chain investigators are most likely to set up reverse ambushes.
The lesson for ordinary users is straightforward: the stolen-funds wallets from old cases won’t disappear—they’re just waiting for a liquidity window. When you see large $SOL suddenly move and get dumped to a CEX or a bridge, stay one notch more alert and don’t be the one on the receiving end.
#OnChainAnalysis #Hack #TornadoCash
A few details are worth watching:
1) The tempo — not a slow, incremental selloff, but a one-stop sequence: sell, bridge, then mix. This clearly bets on the market’s ability to absorb the sell pressure and on the timing gap for on-chain tracing;
2) The route — SOL → ETH → Tornado. It’s almost a textbook move from an old wallet, suggesting that hackers of this type still lack confidence in draining funds from the Solana ecosystem and ultimately return to Ethereum for the final stage of laundering;
3) The timing — acting after such a long period of silence often means they believe the news cycle has cooled and monitoring has relaxed. This is also the moment when on-chain investigators are most likely to set up reverse ambushes.
The lesson for ordinary users is straightforward: the stolen-funds wallets from old cases won’t disappear—they’re just waiting for a liquidity window. When you see large $SOL suddenly move and get dumped to a CEX or a bridge, stay one notch more alert and don’t be the one on the receiving end.
#OnChainAnalysis #Hack #TornadoCash
Log in to explore more content