Rationale for Using Tornado Cash
Published 6/25/2026, 6:23:29 AM
The KyberSwap attacker laundered 2,000 ETH through Tornado Cash to break the on-chain link between the stolen funds and their final destination, effectively evading law enforcement and financial sanctions. This specific transfer, occurring in June 2026, is part of a broader pattern where the attacker has laundered over 80% of the stolen assets—totaling approximately 16,100 ETH (~$40 million)—using the decentralized mixer.
Rationale for Using Tornado Cash
The attacker, identified by the U.S. Department of Justice as Andean Medjedovic, utilized Tornado Cash for several strategic reasons:
- Obfuscation of Origin: Tornado Cash utilizes zero-knowledge proofs (zk-SNARKs) to sever the direct link between the deposit address (the exploiter's wallet) and the withdrawal address. This makes it "extremely difficult" for blockchain analytics firms to trace the funds.
- "Smurfing" Strategy: The attacker broke the 2,000 ETH into smaller, standardized chunks (typically 10 or 100 ETH) before routing them through the protocol. This prevents large, identifiable "lumps" of capital from being tracked through the mixer's pools.
- Bypassing Freezes: By moving funds through a decentralized protocol, the attacker attempts to move assets out of "blacklisted" addresses that centralized exchanges or stablecoin issuers (like Circle or Tether) could otherwise freeze.
- Operational Continuity: Medjedovic has a history of using the protocol; he reportedly used 20 ETH from Tornado Cash to fund the initial exploit on Ethereum [Note: specific 20 ETH funding amount not independently confirmed].
Attacker Profile and Exploit Summary
The exploit, which occurred in November 2023, was described as one of the most sophisticated in DeFi history, utilizing a "tick-based swap manipulation" and rounding errors in concentrated liquidity pools.
| Feature | Details |
|---|---|
| Attacker Identity | Andean Medjedovic (Canadian national, age 21-22) |
| Total Stolen | ~$48.8M - $54.7M (KyberSwap) + ~$16.5M (Indexed Finance) [Contested: The DoJ states ~$65M total for both combined] |
| Total Laundered | 16,100 ETH (~$40 million) |
| Legal Status | Indicted Feb 2025; currently a fugitive wanted by the FBI, IRS, and Homeland Security. |
| Demands | Issued an on-chain ultimatum demanding full control of the KyberSwap company, assets, and governance. [Verified] |
Timeline of Major Fund Movements
The laundering of the 2,000 ETH in June 2026 was the most recent in a series of large-scale transfers following periods of wallet dormancy.
- November 2023: Initial exploit across Arbitrum, Optimism, Ethereum, Polygon, and Base.
- March 2025: 1,600 ETH laundered after the attacker was indicted.
- April 2026: 2,900 ETH laundered (the largest single movement).
- June 2026: 2,000 ETH (~$5 million) laundered through Tornado Cash.
Despite the U.S. Treasury's OFAC sanctions on Tornado Cash, the attacker continues to use the protocol as his primary laundering vehicle, highlighting the difficulty of enforcing sanctions against decentralized infrastructure. While the attacker remains a fugitive, the systematic movement of funds suggests a long-term strategy to liquidate the stolen assets while remaining outside the reach of traditional financial authorities.