Tornado Cash, July–September 2026: nine thefts we traced put 18,391 ETH into the mixer

Bonzo Lend — 4,571.1 ETH. Hedera’s largest lender lost about $9 million on 11 July. The money crossed to Ethereum over LayerZero, Relay and Across and went into Tornado in 63 deposits: 4,405 ETH the same day, the rest on 14 July.

Summer.fi — 3,294.2 ETH. A flash-loan attack on 6 July took 6 million DAI. It was sold for ether through the attacker’s own swap contract, the ether was paid to a second wallet, and that wallet made 56 deposits between 7 and 22 July.

Term Labs — 3,253 ETH. A governance vote almost nobody cast handed the vaults to an attacker on 23 August. The ether sat for twelve days, then all of it went in on 4–5 September. The first public trace had counted 960.

Tectonic — 2,658.9 ETH. After the 30 August exploit on Cronos and a chain rollback that recovered most of the loss, what had already escaped to Ethereum went into Tornado in 48 deposits on 3 September.

Duelbits — 1,370 ETH. The casino’s hot wallets were emptied on five chains on 24 September. Two days later the consolidated ether started going in through four fresh wallets. 1,011.55 ETH was still on the attacker’s wallet on 4 October.

Aztec, the 17 June drain — 1,148 ETH in the quarter. The slowest of the nine: 145 ETH on 1 July, 300 on 7–8 August, 503 on 15 August, 200 on 26 August, each through a single-use wallet. With 10 ETH in June that is the whole 1,158 ETH taken.

The fake GIWA bridge — about 765 ETH. Deposits from 1,331 wallets, drained by the bridge’s own two-signature Safe on 27 September and in the mixer within 27 hours.

Payy — about 682 ETH. USDC released by a forged proof on 24 September, swapped to ether and deposited within about an hour on 26 September.

Coldcard — 649 ETH. The one part of the bitcoin theft that reached Ethereum, through THORChain: 73 deposits on 3–4 September. The other 1,038.85 BTC has not moved.

From the theft to the first Tornado deposit: Bonzo Lend about 10 hours after the first stolen money arrived on Ethereum, Summer.fi 21 hours for the first deposit and sixteen days for the last, GIWA 27 hours, Payy and Duelbits two days, Tectonic four days, Term Labs twelve days, Coldcard five weeks, Aztec six days for the first 10 ETH and ten weeks for the last deposit.

More than half of the 18,391 ETH came from thefts that were completely in the mixer within four days. That is the window in which an exchange, a bridge or an issuer can still do something. In every case the money was ether by then — stablecoins and wrapped bitcoin were swapped first, because ether cannot be frozen by anyone.

The deposits also cluster. On 3–5 September three unrelated thefts — Term Labs, Tectonic and Coldcard — put 6,561 ETH into the same pools in three days. On 26–28 September Duelbits, Payy and GIWA added 2,817 ETH. And 11 July alone took 4,405 ETH from Bonzo. A deposit made on such a day hides among other thieves’ deposits, not among ordinary users.

Almost everything went through the largest pool. Bonzo made 45 deposits of 100 ETH; Duelbits twelve; the Aztec wallets ten. The smaller pools — 10, 1 and 0.1 ETH — were used for the remainders. An attacker who wants to leave quickly has no real alternative: 4,571 ETH through the 10 ETH pool would be 457 transactions.

Tornado is also where several of these began. Bonzo’s wallet received its first ether from the 1 ETH pool three hours before the stolen money arrived; the first Aztec wallet was funded from the 0.1 ETH pool three hours before its exploit; the Base vault attacker’s gas came the same way. A fresh wallet whose first transaction is a Tornado withdrawal, followed within hours by a large inflow, is a pattern worth an alert on its own.

The largest thefts of the quarter did not use it at all. Bitget’s 68,465 ETH left through THORChain and bridges in five days. Smaller amounts tried Railgun: 46 ETH from the Limit Break exploit went in and stayed, while the Nostra attacker’s 19 ETH came back out to the same address within the hour. And a good part simply waits: 909 ETH from the first Aztec drain, 1,011.55 ETH from Duelbits, 794 ETH from Neutron, 433 ETH from Fetch.ai. Those addresses are on our monitor.

This is not Tornado Cash’s total inflow for the quarter and says nothing about its ordinary users. It is the sum of nine incidents we traced to the deposit ourselves; each figure is documented, with addresses and transactions, on the linked page. Thefts we did not trace are not here. The dollar figure uses $2,717 per ETH, the price on 5 October 2026.

You can check any address against these cases on the address check page.