Overview
- The attacker deposited 2,834 ETH into Tornado Cash roughly a year after a $53 million lending-pool exploit.
- On-chain mapping shows funds routed from bridge addresses including Stargate, Synapse and Drift FastBridge into an intermediary wallet beginning 0x4afb.
- One traced path shifted 2,236 ETH to address 0x3fe4 before hops across three additional wallets, reflecting fragmented transfers.
- In August 2025, the exploiter swapped 3,091 ETH for 13.26 million DAI and later back to ether, with holdings near 14,436 ETH plus 35.29 million DAI before the mixer deposit.
- Radiant says it is working with the FBI, Chainalysis, SEAL911 and ZeroShadow to recover funds, while Mandiant has alleged ties to DPRK-linked AppleJeus.