A total of $5.1 million in stolen funds was moved to Tornado Cash via 20 transactions, tracing back to the recent exploit associated with the Jaredfromsubway.eth address. The transfers occurred within hours of the attack, highlighting ongoing vulnerability in DeFi protocols.
The funds were routed through multiple bridges and intermediate wallets before reaching the sanctioned mixer. On-chain data reveals the attacker utilized cross-chain bridges to obfuscate the flow, raising questions about bridge security and compliance. The Ethereum address linked to the attack still holds a significant portion of stolen assets.
This incident reignites scrutiny over Tornado Cash's role following its sanction by the Office of Foreign Asset Control (OFAC) in 2022. Despite legal actions against its developers, the mixer remains operational, processing millions monthly. The U.S. Treasury maintains that any interaction with the protocol is illegal, yet enforcement challenges persist.
At current prices, the transferred $5.1 million represents a fraction of DeFi's total monthly theft volume, which exceeds $100 million per recent reports. However, the use of a sanctioned tool compounds regulatory risk for any protocols or bridges involved, potentially triggering enforcement actions.
Community discussions emphasize the need for improved on-chain surveillance and bridge-level KYC protocols. Competing decentralized exchanges have distanced themselves, with Uniswap clarifying it does not route funds through Tornado Cash. The attack underscores systemic gaps in DeFi's regulatory compliance framework.