Term Labs: all of the stolen ETH went to Tornado Cash, and the DAI went to Robinhood Chain
PublicAML · On-chain investigation · 23 September 2026
On 23 August 2026 an attacker took control of Term Labs’ vaults through a governance vote almost nobody else cast, and drained about $8.5 million: 2,842 ETH and 1.68 million DAI. The first public trace put 960 ETH into Tornado Cash. The chain shows 3,253 — all of it. The DAI took a route almost nobody watches: swapped into Paxos’ USDG and bridged to Robinhood Chain.
3,253 ETH
into Tornado Cash, 4–5 Sep 2026 — all of the stolen ETH
1,679,642
real DAI taken, counted by contract, not by name
1,001,000
DAI swapped to USDG and bridged to Robinhood Chain
4
attacker addresses, now labelled in PublicAML
What happened
Term Labs runs fixed-rate vaults governed by token votes. Turnout was close to zero, so one wallet, funded with about 2 ETH that had passed through Tornado Cash, could pass a proposal on its own and hand itself control of the vaults. The vault code was not broken; the governance around it was. The drain came to 2,842 ETH and 1,679,642 DAI.
The ETH: 960 was the first batch, not the total
The early reports put 960 ETH into Tornado Cash. That was true on the afternoon of 4 September and stopped being true a few hours later. The collection address, 0xD5183d8BfC65a50863C62aF2538198A8288FFc13, passed every ETH it held — 3,241.53 — to a second address, 0xC14007663A5bb9F13d4d2AEE8c6FE9075eF1d83e, which deposited 3,253.10 ETH into the Tornado Router between 4 and 5 September. Nothing of the stolen ETH is left outside the mixer.
The DAI: most of what looks like DAI is not
Open these addresses in an explorer and they appear to move tens of millions of DAI. They do not. Tokens named DAl, DAߊ and similar — with look-alike destinations such as 0x9210…5135 and 0xC140…d83e that copy the attacker’s own addresses — are being pushed at them by address poisoners, who hope the attacker will copy the wrong address back. Counting only the real DAI contract, 0x6b175474e89094c44da98b954eedeac495271d0f, the attacker took 1,679,642 DAI and sent 1,651,000 of it to 0x9210130f81c84d028DB83701fF379A79c9365135 on 1 September.
From there, 650,000 DAI went through KyberSwap into USDC, USDS and ETH. The other 1,001,000 DAI was swapped into USDG — the Global Dollar issued by Paxos — and bridged through LI.FI and Glacis to Robinhood Chain, to 0x87987732702df5aed985389f4b4e99f03d22372d. That address has already moved it on.
| When (2026) | From | To | Amount | Tx |
|---|---|---|---|---|
| 23 Aug | 0xa908b3…00612B | 0xD5183d…8FFc13 | 2,842.24 ETH the stolen ETH | — |
| 23 Aug | 0x686457…520691 | 0xD5183d…8FFc13 | 1,679,642 DAI the stolen DAI (real contract) | — |
| 24 Aug – 5 Sep | 0xD5183d…8FFc13 | 0xC14007…F1d83e | 3,241.53 ETH every ETH it held | — |
| 4–5 Sep | 0xC14007…F1d83e | 0xd90e2f…24F31b | 3,253.10 ETH Tornado Router | — |
| 1 Sep | 0xD5183d…8FFc13 | 0x921013…365135 | 1,651,000 DAI real DAI | — |
| 1 Sep | 0x921013…365135 | 0x6131B5…6337b5 | 650,000 DAI KyberSwap router | 0xa7ffb6…af4f2b |
| 1 Sep | 0x921013…365135 | 0x879877…22372d | 1,001,000 DAI → USDG LI.FI → Glacis → Robinhood Chain | 0xdf3091…15195f |
Why the route matters
Tornado Cash is the obvious exit and everybody watches it. A young chain reached through a stablecoin swap and a bridge aggregator is not, and that is the point of taking it. USDG is a regulated, issuer-controlled stablecoin: Paxos can freeze it. Whether it still sits in USDG on Robinhood Chain or has been swapped out is what the next hop decides, and it is the question worth putting to the issuer.
All four attacker addresses on this page are labelled in PublicAML, so any exchange or exchanger that screens them will see the history.
Sources: Ethereum chain data via Blockscout, read on 23 September 2026; LI.FI transfer events decoded from the transaction receipts; Robinhood Chain via its public RPC; the incident itself as described by rekt.news. This is an information resource about transactions between addresses, not financial or legal advice, and it names no individual as responsible for anything.