Blockchain security firm CertiK has traced approximately $63 million in deposits to the privacy mixer Tornado Cash back to the massive $282 million cryptocurrency wallet compromise that occurred on January 10, 2026. The firm announced the findings in a social media post, revealing new details about the post-theft money laundering mechanics employed by the attacker.
According to CertiK's analysis, a portion of the stolen Bitcoin (BTC) was bridged to the Ethereum network using a cross-chain swap. At least 686 BTC was converted, resulting in 19,600 ETH received by a single Ethereum address. The funds were then strategically split across multiple wallets, with several hundred ETH sent from each address before finally being deposited into Tornado Cash, a protocol designed to obscure transaction trails.
Marwan Hachem, CEO of blockchain security firm FearsOff, commented on the laundering pattern, stating it follows a "classic large-scale laundering playbook." He noted the use of THORswap for Bitcoin-to-Ether conversions and the breakdown of funds into roughly 400 ETH chunks before entering the mixer were "textbook" tactics to reduce attention. "Tornado Cash is a major kill switch for traceability," Hachem told Cointelegraph, adding that recovery chances "drop to near zero" in most cases after funds enter a mixer.
The initial January 10 theft, tracked by multiple investigators including ZachXBT, was the result of a social engineering attack. The attacker impersonated wallet support staff, tricking the victim into revealing a seed phrase, which granted full control over a wallet containing about 1,459 BTC and over 2 million Litecoin (LTC). While security firm ZeroShadow previously reported that about $700,000 of stolen funds were frozen early on, the vast majority of the assets have moved beyond reach.
The $63 million figure linked to Tornado Cash represents only a portion of the total stolen amount, but it clearly demonstrates the attacker's methodical approach to obscuring the trail through cross-chain transfers, fund splitting, and the use of privacy tools, making recovery increasingly difficult for investigators.
