Blockchain security firms PeckShield and Beosin reported that the suspected hackers who exploited Lendhub, a decentralized financial lending protocol, transferred more than half of their illicit profits to Tornado Cash, a cryptocurrency mixing service. According to Beosin, around 2,415 Ether (ETH), worth approximately $3.85 million, were sent to Tornado Cash from a wallet connected to the January 12 exploit. Beosin also reported that the exploiter has sent a total of 3,515.4 ETH, currently worth more than $5.7 million, to Tornado Cash since January 13.

Tornado Cash is a cryptocurrency mixing service that attempts to anonymize Ethereum transactions by combining large amounts of Ether before depositing sums to other addresses. However, the service was sanctioned on August 8 by the US Office of Foreign Assets Control (OFAC) for its alleged role in laundering the proceeds of crime. Despite the sanctions and removal of the service’s website, Tornado Cash can still be run and used as it is a smart contract hosted on a decentralized blockchain.

A January report from blockchain analytics firm Chainalysis said hacks and scams once contributed around 34% of all inputs to the mixer, with inputs sometimes reaching around $25 million a day. , but that dropped by 68% in the 30 days after the sanctions. . However, bad actors from the space continue to frequent the service. Most recently, on February 20, the exploiter behind an Arbitrum-based DeFi project transferred more than $1.86 million in illegally obtained cryptocurrency to Tornado Cash.

The notorious North Korean hacking team, Lazarus Group, has also been known to send significant sums to mixers like Tornado Cash and Sinbad. A Chainalysis report from early February claimed that funds exploited by North Korean hackers “are moving to mixers at a much higher rate than funds stolen by other individuals or groups.”

The use of crypto mixers by hackers and other bad actors has long been a concern for authorities and regulators, who are trying to crack down on the use of such services for money laundering and other illicit activities. The continued use of Tornado Cash by suspected hackers and other bad actors suggests that more must be done to curb the use of such services.