Aztec vulnerability hackers transferred 500 ETH to Tornado Cash after stealing $2.19 million

According to monitoring by blockchain security company PeckShield, individuals who stole funds from Aztec's abandoned Connect rollup in June this year have now transferred a total of 500 Ethereum pieces to Tornado Cash. The hacker had previously sent 300 Ethereum pieces to the currency mixer, highlighting the evolving methods used by cybercriminals to launder stolen assets in decentralized financial contracts.

Batch withdrawals raise new questions

Unlike some high-profile cases in the past, the attacker chose to make sporadic small transfers rather than quickly deposit large amounts of funds at one time. The most recent transfer of 300 Ethereum pieces (valued at approximately US$572,100 at the time) was recorded on August 8. PeckShield had previously identified a deposit of 145 Ethereum pieces (worth approximately $227.65 million) on July 2, bringing the cumulative amount transferred through Tornado Cash to 200 Ethereum pieces before the latest event.

This deposit was 37 days apart from the previous transfer, indicating that there was a carefully planned timetable behind it. Instead of transferring all 909 Ethereum pieces stolen in the original hacking attack at one time, the attacker split the funds into small batches, and so far, about 55% have been transferred through multiple operations.

The slow transfer of funds through Tornado Cash is in sharp contrast to cases such as the 2022 Beanstalk incident. In the latter case, the perpetrator completed 270 transactions involving 24,930 Ethereum pieces in a very short period of time. Although he also took advantage of the anonymity of the currency mixer, he relied more on speed.

In the case of the Aztec incident, TRM Labs pointed out that transaction time patterns, wallet activity and behavioral characteristics outside of the currency mixer can still provide valuable clues. Despite the intention to conceal asset movements, modern analytical tools, including behavioral correlation analysis and off-site monitoring, have been able to track funds flowing even through mixed-currency agreements.

Origin of the Aztec attack

On June 14, an attacker used a vulnerability in the older version of Aztec Connect rollover contract to steal approximately $2.19 million in a single transaction. According to Blockaid, the stolen assets included 909 Ethereum, 270,513 DAI, 168 wstETH and other tokens.

Then, just a day later, the same attacker used almost the same method to steal another $88,000 of remaining funds from the legacy agreement and clear the remaining bridging positions.

Investigation showed that Aztec's underlying cryptography had not been breached. Instead, Blockaid found flaws in the certification verification and settlement processing that allowed hackers to generate fake balances that did not match the corresponding deposit.

The affected contracts have long since been abandoned, and Aztec Labs no longer owns their management keys. This means that the main Aztec network and current AZTEC tokens were not affected by the attack.

Cyclical trends in cryptocurrency money laundering

The Aztec incident further confirms the continuing pattern in the blockchain security space. TRM Labs reported that a total of 207 cryptocurrency hacking attacks occurred in the first half of 2026, causing losses of US$972 million. Although the total amount of theft has dropped significantly compared with US$2.3 billion in the same period in 2025, the actual number of attacks has increased, including 125 smart contract exploit incidents, with a median loss of US$219,000 per incident.

Tornado Cash continues to play an important role in illicit financial flows, reportedly accounting for 20% of all global currency mixer transactions since 2026. Although its overall market share has declined since the U.S. imposed sanctions in 2022, it remains the dominant service on Ethereum-based platforms.

Academic research from the University of Birmingham and the University of Sydney shows that Tornado Cash contributed to 78.33% of the financial flow of hacking incidents on Ethereum during the period studied, showing that even after regulatory crackdowns, it still has continued influence among cybercriminals.

In March 2025, the legal environment changed and the U.S. Treasury Department lifted sanctions on Tornado Cash. The Fifth Circuit Court's ruling clarified that immutable smart contracts do not fall within the property jurisdiction of the Office of Foreign Assets Control.

For users and decentralized financial participants, the slow withdrawal strategy observed in the Aztec case highlights the ongoing risks of legacy smart contracts. Funds stuck in the old agreement remain fragile, and once stolen, money laundering methods rarely deviate from established patterns.

Against the backdrop of increasing market scrutiny of attack patterns and technical vulnerabilities, comprehensive tracking of wallet flows, transaction size and timing has become increasingly important. Investors can more easily monitor key indicators and quickly respond to market dynamic events by integrating real-time macro data such as cryptocurrency prices, portfolio management, and Federal Reserve interest rates, as well as a unified dashboard with customized reminders.