Aztec exploits: the 909 ETH never moved — the Tornado Cash deposits came from a different drain

Aztec Connect was shut down in 2023, but its contracts are immutable and people’s money was still inside. According to Aztec Labs’ incident report, on 14 June 2026 at 12:26 UTC an attacker submitted 14 crafted rollups and withdrew balances that were never backed: 908.99 ETH, 270,513 DAI, 167.89 wstETH and smaller amounts of LUSD and Yearn vault tokens — about $2.19 million at the time. All of it went to one wallet, 0x0F18D8b44a740272f0be4d08338d2b165b7EdD17, funded three hours earlier with 0.1 ETH from Tornado Cash.

On 15 June a second wallet, 0x7ec9F769d932D3f716949E7ca3E079b7817d06DB, repeated the method on what was left — wrapped Aave and Compound positions worth about $88,000 — and converted them to 46.5 ETH.

On 17 June at 18:34 UTC a third wallet, 0x6952d9246e9aFE8B887B2877225163436F78E97F, used the escape hatch of the older rollup contract — Aztec’s first private-payments rollup, 0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba — and took 1,158 ETH in one transaction. Its gas came from the hot wallet of an instant-exchange service thirteen minutes earlier.

We do not know whether one person did all three. The three wallets were funded three different ways and never sent anything to each other. What we can say is where each one’s money is.

On 5 October 0x0F18D8b44a740272f0be4d08338d2b165b7EdD17 holds 909.08 ETH, 270,513.05 DAI, 167.89 wstETH, 9,273.73 LUSD and the Yearn vault tokens — exactly what it took on 14 June. Its last outgoing transaction is the exploit itself. The only later entries in its history are zero-value messages sent *to* it by strangers. At today’s price of about $2,717 per ETH that is roughly $3.3 million sitting on one address.

None of it can be frozen by an issuer: ETH, wstETH, DAI and LUSD have no freeze function. The only thing that can still stop this money is the exit — an exchange or service that screens deposits.

Reports in July and August, citing PeckShield, described “the Aztec exploiter” sending 145 ETH to Tornado Cash on 2 July and 300 ETH on 8 August, and presented it as 55% of the 909 ETH from the 14 June theft, laundered on a slow timetable.

Those deposits exist, and their dates and sizes match — but they trace back to the 17 June wallet, not the 14 June one. The 1,158 ETH was split the same evening, regrouped the next day on 0x69923e5264b6E1634Ee673F34fc6350Cb7A05f72 (1,100.93 ETH) with 56 ETH on a side wallet, and then fed to Tornado through fresh single-use addresses: 10 ETH on 23 June, 145 ETH on 1 July, 300 ETH on 7–8 August, 503 ETH on 15 August and 200 ETH on 26 August.

That adds up to 1,158 ETH — the whole amount. The slow drip the headlines described ended five weeks ago; nothing from this drain is left to watch.

The 15 June money took the shortest path: 0x7ec9F769d932D3f716949E7ca3E079b7817d06DB → 0xc431470AACaC667B949eCA4049A766d3d172c1f5 → 0x0aF7F8F2EA8B5B91928A705863Ade4f373939912, and five deposits of 10 ETH into Tornado Cash at 06:58–06:59 UTC, under two hours after the drain.

Aztec Labs’ report describes this ether as going toward “a high-volume service contract” ending in f31b that had received deposits from about 1,900 addresses, “consistent with depositing into a centralised exchange or a swap service”. That contract is 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b — the Tornado Cash router. The money did not go to an exchange.

We have marked the three exploit wallets and the relay and deposit addresses of the second and third drains as hack-related in our database, and the first wallet is on our monitor: if the 909 ETH moves, we will update this page. We did not mark the instant-exchange hot wallet that supplied gas for the third drain — it is a shared service used by thousands of unrelated people.

You can check any address against this and our other cases on the address check page.

It names nobody and does not claim the three drains were one actor. The mechanism and the per-asset losses of 14–15 June are Aztec Labs’ account; balances, routes and Tornado totals are ours, read from the chain on 5 October 2026.