Pando Rings Exploiter Moves 4,000 ETH Through Tornado Cash After Four Years
Key Summary
Four years after the 2022 Pando Rings exploit, the attacker laundered 4,000 ETH through Tornado Cash following a complex series of stablecoin swaps and lending maneuvers on Aave.
Key Bullets
- On-chain transaction data monitored Monday confirms the Pando Rings exploiter pushed 4,000 ETH through Tornado Cash in batches of 100 ETH deposits.
- Public blockchain records show the attacker first converted $16.98M in Dai into 7,548 ETH using Aave liquidity pools before initiating mixer transfers.
- According to blockchain investigators, exactly 3,548 ETH from the exploit remains outside the mixer in unassociated cold storage wallets.
- Exchange order-book monitoring confirms no direct spot deposits or immediate selling pressure have hit major CEX venues yet.
Attacker Moves 4,000 ETH Through Mixer
Four years after the 2022 Pando Rings protocol exploit, the attacker routed 4,000 ETH through Tornado Cash on Sunday. On-chain transaction records confirm the deposits broke down into multiple chunks of 100 ETH each. Each batch was valued at approximately $229,000 based on spot rates at the time of the transfer. The privacy protocol obscured the transaction origins completely.
The latest mixing activity followed an earlier 800 ETH deposit tracked by blockchain sleuths in August. Public data indicates the actor has steadily reactivated dormant infrastructure. Investigators must now rely on off-chain pattern recognition. The mixing process destroys direct wallet links.
Aave Protocols Used For Token Swaps
Before hitting the mixer, the attacker utilized Aave to cycle stablecoins into native assets. Filings with public on-chain ledgers show the wallet supplied 16.80M USDT as collateral. The actor then borrowed and repaid 5,000 ETH to shuffle capital. This maneuver allowed the conversion of 16.70M DAI into 7,548 ETH.
The swapping sequence masked the initial capital trail across different liquidity pools. On-chain monitoring from analytics dashboards verified the exact routing path. The attacker left 3,548 ETH outside the mixer. Those remaining tokens sit in separate addresses.
Exchange Order Books Show No Selling Pressure
Direct exchange order-book monitoring monitored by market data providers shows zero confirmed token deposits at centralized venues. Spot trading desks recorded no unusual volume spikes tied to the exploit address. The attacker appears to be holding the unmixed inventory for now. Immediate liquidation risks remain low.
Recovery efforts face severe hurdles due to the use of zero-knowledge privacy pools. Blockchain security firms continue monitoring remaining wallet clusters for outbound exchange flows. Investigators lack definitive visibility into the final destination of the washed capital. The asset movement remains an active case.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.