An address linked to the Aztec bridge exploit has deposited 300 ETH into Tornado Cash, according to reports from crypto.news and Coinpedia. Both outlets described the transfer as part of a continuing pattern of moving funds through the mixing service following the original exploit.
Tornado Cash is a decentralized mixing protocol that obscures the origin and destination of transactions on Ethereum. It has long been used by attackers seeking to break the on-chain link between stolen assets and their eventual destination. The U.S. Treasury sanctioned Tornado Cash in 2022, though the service has continued to operate and remains a common destination for exploiters.
Aztec is a privacy-focused Ethereum layer-2 network built around zero-knowledge technology. Bridges connecting layer-2 networks to Ethereum’s mainnet have repeatedly been targeted by attackers because they often hold significant pooled liquidity. Bridge exploits have accounted for some of the largest thefts in crypto history, making their monitoring a priority for blockchain security firms.
The latest 300 ETH transfer follows what both reports describe as an established pattern of the exploiter moving funds in tranches rather than all at once. Splitting large sums into smaller batches is a common laundering tactic. It can make it harder for investigators and blockchain analytics firms to track the full scope of stolen assets in real time.
At current market conditions, 300 ETH represents a substantial sum, though its exact dollar value fluctuates with Ethereum’s price. Blockchain forensics firms typically flag such transfers quickly, tagging associated wallet addresses to alert exchanges. This can help prevent laundered funds from being easily converted into fiat currency.
Neither crypto.news nor Coinpedia detailed the original exploit’s total size or the exact timeline of prior transfers. Both reports focused specifically on this latest movement of funds into Tornado Cash, framing it as a continuation of the exploiter’s laundering activity.
Sources disagree on this story
This article was published before the reports below were compared. The reporting above stands; what follows is where the published accounts do not agree.
Cryptopolitan and crypto.news agree on the 500 ETH sent to Tornado Cash but give conflicting figures for the underlying Aztec exploit's total loss and the specific assets stolen.
What all sources agree on
- A wallet linked to the Aztec exploit deposited another 300 ETH into Tornado Cash on August 8, per PeckShield.
- The latest 300 ETH deposit was worth roughly $572,000/$572,100 at the time.
- The wallet's cumulative Tornado Cash deposits now total 500 ETH.
- The affected contracts were a deprecated/legacy Aztec product, separate from the current Aztec network and AZTEC token.
- Aztec Labs/Aztec Labs could not pause or upgrade the affected contract because it had surrendered administrative keys.
- The U.S. Treasury removed Tornado Cash from its sanctions list in March 2025 following a federal court ruling.
Where the reports disagree
1Total value lost in the underlying exploit
The Private Rollup Bridge lost approximately $2.165 million in a June exploit.
The June Aztec Connect exploit drained about $2.19M, with stolen assets including 909 ETH, 270,513 DAI and 168 wstETH.
What would settle it: On-chain transaction data from the exploited contract's transfer history.
2Specific assets and amounts stolen
The stolen assets reportedly included 1,158 ETH, 150,000 DAI and 0.47 renBTC.
As per Blockaid, the stolen money includes 909 ETH, 270,513 DAI, 168 wstETH, and other assets.
What would settle it: The exploited contract's on-chain withdrawal records or a blockchain security firm's forensic report specifying token-by-token amounts.
What to make of it
Treat the 300 ETH Tornado Cash deposit and the 500 ETH cumulative total as established, since both outlets cite the same PeckShield alert; do not treat the total exploit loss or the specific stolen-asset breakdown as settled, since the two reports give different figures for both.
Market Impact
Repeated movements of stolen funds into Tornado Cash tend to draw renewed scrutiny toward the mixing service and toward layer-2 bridge security more broadly. Exchanges and compliance teams often respond to such reports by tightening monitoring of wallets connected to the exploit, which can slow an attacker's ability to cash out.
For the broader Aztec ecosystem, continued laundering activity linked to the exploit keeps the incident in public view. This may affect user confidence in bridge infrastructure until the network or affected parties provide further updates on remediation or fund recovery efforts.
The transfer underscores how exploiters continue to rely on Tornado Cash despite its sanctioned status, while blockchain investigators keep tracking the funds in an effort to limit further laundering.
Frequently Asked Questions
What is Tornado Cash?
Tornado Cash is a decentralized Ethereum mixing protocol that obscures transaction origins and destinations. It was sanctioned by the U.S. Treasury in 2022 but remains operational.
What is the Aztec bridge exploit?
It refers to an attack on a bridge connecting the Aztec layer-2 network to Ethereum, from which funds were reportedly stolen and are now being moved through mixing services.
Why do exploiters move funds in smaller batches?
Splitting large sums into smaller transfers can make it harder for investigators and analytics firms to trace the full amount of stolen assets in real time.
Can funds sent to Tornado Cash still be tracked?
Blockchain forensics firms often flag wallets linked to known exploits, which can help exchanges block laundered funds even after they pass through a mixer.