Pando Rings Hacker Launders $9.22 Million in ETH Through Tornado Cash After Four Years
A cryptocurrency wallet linked to the 2022 Pando Rings exploit has transferred 4,000 Ethereum (ETH), worth approximately $9.22 million, through Tornado Cash. The transaction comes nearly four years after attackers stole millions from the decentralized finance project.
Blockchain monitoring data published on November 2, 2026, revealed the movement following a substantial Ethereum purchase. The transfer has renewed concerns about stolen cryptocurrency entering privacy-focused services, potentially complicating efforts to trace and recover the assets.
Pando Rings Hacker Converts Millions Into Ethereum
On-chain monitoring identified a wallet associated with the Pando Rings exploit that recently acquired 7,548 ETH using approximately 16.98 million DAI.
The purchase occurred at an average price of roughly $2,249 per ETH, following a broader cryptocurrency market decline. Shortly afterward, the wallet transferred 4,000 ETH into Tornado Cash, representing approximately 53% of its reported Ethereum acquisition.
Additional blockchain monitoring revealed earlier activity involving the decentralized lending platform Aave. On October 30, the address reportedly deposited 16.8 million USDT, borrowed 5,000 ETH, repaid the loan, and withdrew its collateral.
These transactions suggest the wallet operator actively managed substantial cryptocurrency holdings before routing funds through the privacy protocol.
Tornado Cash Transfer Complicates Fund Tracking
Tornado Cash allows users to obscure transaction connections by pooling cryptocurrency deposits and processing withdrawals through privacy-focused smart contracts.
Although Ethereum transactions remain publicly visible, the service makes linking deposits to subsequent withdrawals considerably more difficult. Consequently, investigators may face additional obstacles when attempting to follow funds associated with the Pando Rings exploit.
The original attack occurred on November 5, 2022, when attackers exploited a price oracle vulnerability. Reports estimated the resulting losses at approximately $20 million to $22 million.
The latest transfer highlights how stolen cryptocurrency can remain active years after an exploit. However, the movement into Tornado Cash does not establish that the attacker successfully converted the assets into untraceable funds.
Ethereum Selling Pressure Remains Uncertain
The reported 7,548 ETH acquisition exceeded the amount transferred into Tornado Cash by 3,548 ETH. However, that difference does not independently confirm the wallet’s remaining balance.
Furthermore, available monitoring reports have not established that the transferred Ethereum reached a centralized exchange or was sold.
For cryptocurrency investors, the distinction matters because large transfers do not automatically create immediate selling pressure.
The incident underscores persistent security challenges across decentralized finance. While blockchain transparency helps investigators identify suspicious wallet activity, privacy tools can make subsequent fund movements considerably harder to reconstruct.
