Term Labs: all of the stolen ETH went to Tornado Cash, and the DAI went to Robinhood Chain

Term Labs runs fixed-rate vaults governed by token votes. Turnout was close to zero, so one wallet, funded with about 2 ETH that had passed through Tornado Cash, could pass a proposal on its own and hand itself control of the vaults. The vault code was not broken; the governance around it was. The drain came to 2,842 ETH and 1,679,642 DAI.

The early reports put 960 ETH into Tornado Cash. The full count is larger. The collection address, 0xD5183d8BfC65a50863C62aF2538198A8288FFc13, passed every ETH it held — 3,241.53 — to a second address, 0xC14007663A5bb9F13d4d2AEE8c6FE9075eF1d83e, which deposited 3,253.10 ETH into the Tornado Router in three waves: 300 ETH on 24 August, 900 ETH on 4 September and 2,053.10 ETH on 5 September. Nothing of the stolen ETH is left outside the mixer.

Why does a 2,842 ETH theft add up to 3,241 ETH passed on? Because 398 ETH went round twice — see the next section.

On 4 September at 14:08–14:09 UTC 0xC14007663A5bb9F13d4d2AEE8c6FE9075eF1d83e deposited 4 × 100 ETH into Tornado. Twenty minutes later, at 14:28–14:46 UTC, a fresh address, 0xb3C5Ec79E1a986001FD028bC347514d4AB434ddA, withdrew 4 × 100 ETH from the same pool through a relayer and received 398.35 ETH.

At 14:53 UTC it sent 398.34 ETH to the Across bridge. The bridge did not complete the transfer and refunded 398.34 WETH at 17:33 UTC. At 17:40 UTC, seven minutes after unwrapping it, the address sent 398.34 ETH to the attacker’s own collection address, 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. That evening and the next morning the collection address passed its ETH, these 398.34 included, back to 0xC140…d83e, which put it into Tornado again.

A withdrawal that pays straight back into the attacker’s address leaves little doubt about who made it. It also means 398 ETH of the 3,253 was deposited twice: the stolen ETH that reached the mixer is about 2,855 ETH.

How we found it: we took all 8,498 withdrawals from the four ETH pools in the month after the deposits and kept only recipients that had dealt with the attacker’s addresses or with their direct counterparties. One remained. Run blind on the Triple-A case, the same method found the one withdrawal we had traced there by hand. The many zero-value transfers around the address come from look-alike addresses — address poisoning, not a second actor.

Open these addresses in an explorer and they appear to move tens of millions of DAI. They do not. Tokens named DAl, DAߊ and similar — with look-alike destinations such as 0x9210…5135 and 0xC140…d83e that copy the attacker’s own addresses — are being pushed at them by address poisoners, who hope the attacker will copy the wrong address back. Counting only the real DAI contract, 0x6b175474e89094c44da98b954eedeac495271d0f, the attacker took 1,679,642 DAI and sent 1,651,000 of it to 0x9210130f81c84d028DB83701fF379A79c9365135 on 1 September.

From there, 650,000 DAI went through KyberSwap into USDC, USDS and ETH. The other 1,001,000 DAI was swapped into USDG — the Global Dollar issued by Paxos — and bridged through LI.FI and Glacis to Robinhood Chain, to 0x87987732702df5aed985389f4b4e99f03d22372d. That address has already moved it on.

Tornado Cash is the obvious exit and everybody watches it. A young chain reached through a stablecoin swap and a bridge aggregator is not, and that is the point of taking it. USDG is a regulated, issuer-controlled stablecoin: Paxos can freeze it. Whether it still sits in USDG on Robinhood Chain or has been swapped out is what the next hop decides, and it is the question worth putting to the issuer.

All four attacker addresses on this page are labelled in PublicAML, so any exchange or exchanger that screens them will see the history.