Constructed attacker transfers escaped ETH to Tornado Cash

PeckShield disclosed: Tectonic hacked funds flowed to Tornado Cash

According to PeckShield, on September 3 UTC time, addresses related to the Tectonic hacking were transferred to Tornado Cash, worth approximately US$6.65 million. The deal was a significant part of the unrecovered funds that Cronos recovered through the rollback chain after the August 30 incident.

This target address is far more important than Cronos itself. Tornado Cash remains the largest currency mixer on the Ethereum-based network, which has attracted high attention to the transaction by exchanges, investigators and traders tracking stolen cryptocurrencies.

Roll back unreachable funds

On August 30, when Tectonic, Cronos's largest lending platform, was hollowed out, the verification node quickly stopped the network. Cronos subsequently claimed that it had restored the chain to its pre-attack state and resumed block generation starting with block number 90,896,189.

This rollback eliminated most of the balances on Cronos associated with the attacker, but was unable to reverse any funds that had been transferred to Ethereum. According to PeckShield, approximately $74 million in stolen funds could be traced through three addresses, of which $60 million was in one of the Cronos wallets,$8 million was in the second wallet, and $6 million was on Ethereum.

According to The Defiant, the balance of Ethereum at that time reached 2,592.2152 ETH, equivalent to US$6.29 million. Data provided by TRM Labs shows that hackers initially transferred the funds out of Cronos through the USDC and then converted it into approximately 2,500 ETH.

This article uses the figure of US$75 million, based on reports from TRM Labs and data from on-line researcher Weilin Li. The approximately $74 million reported by PeckShield is the rounded value of funds withdrawn from three tracking addresses. The $119.5 million figure is based on a larger reconstruction of archive nodes, including contracts set up by hackers before the vulnerability was exploited.

Hundreds of times of inflation hollowing out Cronos's largest lender

The attack targeted tokens with insufficient market depth. TRM Labs pointed out that TONIC's trading volume in the week before it was hacked was only $305,000, despite its mortgage ratio of 20%. According to Halborn, the hackers pushed up TONIC's price about 100 times in 20 minutes and used the highly valued token to leverage harder assets from nine lending agreements.

Previous reports from Cryptopolitan pointed out that once Li discovered the wallet of the second attacker, the estimated amount of damage increased from approximately US$66 million to approximately US$75 million. According to DeFiLlama data, Tectonic's total lock-in value (TVL) dropped to approximately $3 million from approximately $121.7 million before the hack.

Why the ripple effect of US$6.65 million deposits exceeds the Cronos range

Compared with the entire crypto market, Tornado Cash's deposit amount is small, but its path is significant. TRM Labs reports that as of June 2026, Tornado Cash has received more than US$700 million and continues to exist as the largest currency mixer in the Ethereum-based network.

TRM also documented its use by ransomware groups, cybercriminals and North Korea's "Lazarus Group", while pointing out that the agreement has legitimate privacy purposes. The US Treasury Department removed Tornado Cash from its sanctions list on March 21, 2025.

Cronos 'reaction raises another issue: finality. Halborn said that while rolling back reduced losses, it came at the expense of confidence in the immutable nature of the books. Cryptopitan reported that during the initial shock period, CRO prices fell by about 10% in 24 hours, while CoinMarketCap later attributed the continued weakness to exploits, downtime and rollbacks.

A record year for price manipulation attacks

Tectonic is in line with broader security trends. PeckShield statistics show that there were 50 major hacking attacks in August, a 67% increase from 30 in July, although total losses fell 49.5% from $270 million to $136.3 million. Tectonic was the largest incident in August, ranking at the time as the fourth largest cryptocurrency theft in 2026. [TAG

TRM Labs says price manipulation exploits reached an all-time high in 2026, with 32 recorded so far.

Weaknesses are not always code errors. When illiquid collateral is endowed with meaningful lending capabilities, attackers can target the price of trust in the agreement. Tectonic shows how quickly this risk spreads-from illiquid tokens, to lending agreements, to chain rollbacks, and finally into the cross-chain money laundering ecosystem.