A wallet linked to the 2022 Pando Rings exploit has resurfaced after years of limited activity, drawing renewed attention to the movement of funds associated with one of the protocol’s largest security incidents.
On-chain monitoring identified an address associated with the exploiter as it converted roughly $10 million in DAI into more than 6,300 ETH in early June 2026. The purchases occurred near an average price of about $1,600 per ETH. However, blockchain attribution remains based on transaction-flow analysis rather than definitive proof of ownership.
The wallet later moved 100 ETH to Tornado Cash, a privacy-focused cryptocurrency mixer. That transfer has increased scrutiny because the address is linked to funds from the earlier exploit.
The 2022 Pando Rings Attack
Pando Rings suffered an oracle manipulation attack in November 2022. Pando said the attacker manipulated the price of an LP token and attempted to extract roughly $70 million in crypto assets.
The protocol reported that about $21.9 million in assets, including ETH, EOS and BTC, left the attacker’s Mixin wallets before countermeasures took effect. Pando also said it froze a substantial portion of the remaining funds with assistance from Mixin Network and its community.
The protocol later restored parts of its services while changing lending and collateral controls following the attack.
New Activity Raises Tracking Concerns
The latest transactions show that funds linked to the exploit remain active years after the original incident. The large ETH purchase also illustrates how dormant crypto assets can re-enter markets without warning.
Furthermore, the transfer to Tornado Cash makes subsequent movements harder to trace. Investigators and blockchain analysts can still follow transactions entering and leaving public addresses, but privacy tools can complicate attribution.
For crypto markets, the activity highlights the continuing risks associated with compromised wallets and long-dormant exploit proceeds. Traders and compliance teams are likely to watch the associated addresses closely for further ETH movements or attempts to convert the assets into other cryptocurrencies.
