TLDR
- The hacker behind the $27.3 million multisig crypto wallet breach has started moving funds through Tornado Cash.
- The attacker has laundered 6,300 ETH worth $19.4 million using structured 100 ETH deposits.
- The same wallet withdrew 1,000 ETH worth $3.24 million from Aave before laundering the funds.
- The hacker currently holds a $9.75 million leveraged long position using $10.7 million in DAI on Aave.
- On-chain monitors identified a separate $7 million laundering case linked to a pig-butchering scam.
The attacker behind the $27.3 million multisig crypto wallet breach has begun liquidating stolen funds through Tornado Cash, transferring 6,300 ETH worth $19.4 million across multiple transactions, and has also withdrawn $3.24 million in ETH from Aave, continuing laundering efforts with precision, according to blockchain security firms.
Multisig Wallet Hacker Holds Leveraged Position
The perpetrator withdrew 1,000 ETH, valued at $3.24 million, from the decentralized finance platform Aave. The hacker immediately routed the assets through Tornado Cash in 100 ETH batches, according to data from PeckShield.
This method disrupts tracking efforts by breaking the link between deposit and withdrawal addresses. PeckShield confirmed the hacker has so far laundered 6,300 ETH worth $19.4 million through the privacy protocol.
“The drainer, who controls the compromised multisig, holds a $9.75M leveraged long position,” PeckShield stated on X. This position includes $20.5 million in ETH against $10.7 million in DAI as collateral on Aave.
The leveraged setup complicates recovery efforts as forced liquidation could lead to asset movement and value extraction. Still, on-chain monitors are tracking these developments as the attacker continues to manage risk.
$7M Pig-Butchering Scam Funds Washed Through Tornado Cash
A separate laundering case also triggered attention from on-chain analysts and crypto monitoring firms. Specter, an on-chain analyst, reported that $7 million was bridged from TRON to Ethereum before hitting Tornado Cash.
He stated that the funds originate from multiple TRON wallets associated with a pig-butchering investment scam. PeckShield validated this, revealing that one address sent 2,479.1 ETH, worth approximately $7.9 million, through the privacy tool.
These deposits occurred in structured 100 ETH batches, matching the earlier pattern seen in the $27.3M theft. The repeated structure further obstructs tracing and heightens complexity in laundering investigations.
Funds originating on TRON and ending in Ethereum indicate a cross-chain laundering operation. This tactic spreads activity across networks, delaying identification and law enforcement response.
UXLink Exploiter Swaps $WBTC for $DAI After September Hack
PeckShield also reported a separate incident involving the wallet labeled as the UXLink exploiter. Within one hour, the address swapped 248 WBTC for 23 million DAI on-chain, showing fresh movement.
This wallet ties back to the September 22 exploit, where billions of unauthorized tokens were minted. The same attack led to losses of tens of millions in stolen cryptocurrency from affected protocols.
This case highlights the continued threat from previously active addresses tied to major protocol breaches. Investigators continue tracking the asset flows, especially those using Tornado Cash for obfuscation.
Industry data shows over $117.8 million was lost in exploits in December alone. Certik reports that $127 million was stolen in November, with $45 million recovered or frozen. December also saw an $8.5 million loss from the Trust Wallet browser extension exploit. That attack followed an earlier $50 million address poisoning incident in the same month.
A Chainalysis report estimated that the top ten 2025 crypto hacks totaled $2.2 billion in stolen funds. That figure excludes the late December Trust Wallet incident, which pushed the total losses higher.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
