Four years after the 2022 Pando Rings exploit, the attacker is once again using Tornado Cash to launder the stolen funds. The wallet first converted approximately $16.98 million in Dai [DAI] to 7,548 Ethereum [ETH] and began dividing the assets into multiple small transfers.
Multiple transactions were found showing a series of 100 ETH deposits, each worth approximately $229,000.
To move their funds, the attacker initially used Aave [AAVE] to convert stablecoin holdings to ETH before sending them through Tornado Cash. At the end of October, the attacker supplied 16.8 million USDT as collateral to borrow 5,000 ETH and repay the loan.
After repaying the loan, the attacker withdrew the collateral and exchanged 16.7 million DAI for 7,548 ETH. These steps show how the attacker consolidated funds by lending and swapping tokens before laundering them.
Thereafter, the attacker made a partial deposit of 4,000 ETH to Tornado Cash and left 3,548 ETH outside the mix. In doing so, this transfer complicated both the recovery of the funds and obscured the eventual destination of the funds.
However, it did not establish whether the funds were immediately sold or if there was widespread selling pressure on exchanges.
As the exploiter continues to break up and hide the trail of these funds, he also increases the chances of distributing additional funds and complicating recovery efforts. Still, the deposits themselves do not establish that the exploiter has either sold his ETH or transferred it to exchanges.
Tornado Cash breaks the transaction trail
Tornado Cash complicates the recovery process. This is because it removes the link between a user and other parties in a transaction. For example, when multiple users place their funds into Tornado Cash, the funds enter a shared pool.
Once placed in the pool, funds may be returned to users through a new wallet address. As such, investigators can rely less heavily on tracking wallets directly related to the theft.
This creates another challenge for investigators, who must rely on transaction patterns and off-chain intelligence to identify where the ETH eventually moves. The exploiter’s earlier 800 ETH deposit in August also shows that this approach predates the latest transfers.
However, the current deposits have yet to generate any connections to wallets associated with known clusters. Until some of these funds appear at identifiable exchange addresses, investigators have little visibility into what is happening. Immediate selling pressure also remains unconfirmed.
Ultimately, the Pando Rings exploit remains an active recovery challenge. Continued laundering activity obscures fund movements. However, there are still no confirmed exchange deposits.
Final Summary
-
The Pando Rings exploiter has resumed laundering funds four years after the attack, moving 4,000 ETH through Tornado Cash.
-
The renewed activity complicates fund recovery, while 3,548 ETH remain outside the mixer, and no exchange deposits confirm immediate selling.