What happened
CertiK's on-chain team posted the attribution early Tuesday, saying it had tied a cluster of Tornado Cash deposits to the wallet responsible for a $1. 58 million drain earlier in the week, per CryptoBriefing's reporting. The firm did not name the victim protocol or user in the initial note, but said the stolen balance was moved into the Ethereum mixer in staggered deposits, a tactic designed to break the direct link between the drained address and any eventual off-ramp.
CertiK's alerts channel is one of the first places exchanges watch for tagged addresses, and the firm has become a de facto early-warning service for compliance desks tracking stolen funds. The deposits followed the familiar pattern: a short window between the drain and the first mixer hop, then a steady drip rather than a single large transfer. That cadence is what blockchain analytics firms use to cluster wallets, and it is why the laundering trail, even through a mixer, is rarely as clean as attackers assume.
Why it matters
The headline number is modest by exploit standards. The pattern isn't. Tornado Cash has been under OFAC sanctions since August 2022, and the Fifth Circuit vacated the sanctions on the smart contracts in late 2024, a ruling that has left compliance teams in a gray zone ever since.
Drained wallets keep routing through it because, legal status aside, the mixer still works as a privacy layer on Ethereum and the alternatives are either less liquid or more heavily surveilled. For security firms like CertiK, the real signal here is upstream of the mixer. The $1.
58 million did not leave because of a novel exploit. It left because someone, somewhere, lost control of a key. That is the recurring story in 2026: protocol code has hardened, but seed phrases, hardware wallets, and signer workflows remain the soft target.