Pando Rings Hacker Moves 3,500 ETH to Tornado Cash as Laundering Resumes

The perpetrator behind the Pando Rings exploit, which resulted in a loss of approximately $70 million four years ago, has resumed activity by transferring another 3,500 ETH to the decentralized mixing protocol Tornado Cash. On-chain data indicates that this recent transaction is part of a broader effort to obscure the origin of stolen funds following a strategic conversion of stablecoins into Ethereum during a period of market volatility.

Strategic Asset Conversion and Fund Movement

According to monitoring data provided by on-chain analyst Yu Jin, the hacker previously utilized 16.98 million DAI to acquire 7,548 ETH. This accumulation occurred at an average purchase price of $2,249 per token, effectively capitalizing on a market downturn triggered by news surrounding a Binance security incident. By converting stablecoins into a more liquid and volatile asset like Ethereum, the attacker prepared for the final stages of the laundering process.

• The hacker initially transferred 4,000 ETH (worth $10.22 million) to Tornado Cash.
• The latest transaction involved 3,500 ETH, valued at approximately $8.42 million.
• A total of 7,500 ETH from the recent purchase batch has now been processed.

Persistence of DeFi Security Breaches

The Pando Rings incident, which dates back four years, remains a significant case study in the longevity of decentralized finance (DeFi) security threats. The use of Tornado Cash, a non-custodial privacy solution on the Ethereum blockchain, continues to be a primary method for attackers to break the deterministic link between transactions.

Tornado Cash operates by pooling deposits from various users and allowing withdrawals to new addresses, making it difficult for law enforcement and analysts to track the flow of illicit capital.

In summary, the movement of 3,500 ETH brings the total laundered from this specific batch to 7,500 ETH, leaving only a marginal amount of the recently converted assets in the attacker's known wallets. This persistent activity highlights the challenges faced by investigators when dealing with dormant funds from historical exploits that suddenly re-enter the ecosystem.