Transit Finance Attacker Moves $1.8M Stolen ETH to Tornado Cash

The perpetrator behind the recent exploit of the cross-chain aggregation protocol Transit Finance has initiated the laundering of stolen assets. According to data monitored by the blockchain security firm CertiK, an Ethereum address linked to the attacker transferred 832.9 ETH, valued at approximately $1.8 million, into the decentralized mixing service Tornado Cash. This movement of funds marks a significant escalation in the aftermath of the security breach that occurred earlier this month.

Details of the On-Chain Activity

The transaction originated from an Ethereum wallet beginning with the prefix 0x9db8. Security analysts observed the funds being funneled into Tornado Cash, a protocol frequently utilized by malicious actors to obscure the transaction history and origin of digital assets. By using zero-knowledge proofs, such mixers allow users to break the on-chain link between the depositor and the withdrawer, complicating the efforts of law enforcement and forensic researchers to track the stolen capital.

• Asset: Ethereum (ETH)
• Volume: 832.9 units
• Estimated Market Value: $1.8 million
• Destination: Tornado Cash

Background of the Transit Finance Breach

The initial exploit of Transit Finance took place on May 13, 2026, resulting in a total loss of approximately $1.88 million. The protocol, which facilitates liquidity across multiple blockchains, became the target of a vulnerability that allowed the attacker to drain funds. While the project team has been working to mitigate the impact, the recent transfer of nearly the entire stolen sum indicates that the attacker is actively seeking to exit their position and liquidate the funds through non-custodial privacy tools.

The movement of these funds highlight the ongoing challenges faced by decentralized finance (DeFi) platforms in securing cross-chain infrastructure. As the investigation continues, security firms remain on high alert for any further activity from associated wallets. The use of Tornado Cash in this instance underscores the persistent role that privacy-enhancing protocols play in the lifecycle of cryptocurrency heists, despite increased regulatory scrutiny and the blacklisting of specific smart contract addresses.