Stolen Triple-A Treasury Funds Moved into Tornado Cash
Attackers laundered approximately $12.4 million in Ether stolen during a July breach of the company treasury.
Updated on Oct. 10, 2026 in Cybersecurity
Live Poll
Should regulators place stricter limits on the use of cryptocurrency mixers like Tornado Cash?
Hackers have moved 4,970 Ether, currently valued at roughly $12.4 million, into the privacy protocol Tornado Cash. The funds were traced back to a July 2026 security breach affecting the Triple-A treasury.
Why it matters
The movement of these assets through privacy-focused mixers highlights the ongoing challenges of on-chain asset recovery following large-scale institutional breaches. Triple-A has confirmed that customer-held funds were not impacted by the initial theft.
The attackers completed 56 individual transactions to move the assets, consisting of 49 deposits of 100 ETH and 7 deposits of 10 ETH. This activity followed a consolidation process where assets stolen in July were bridged, exchanged, and split across two intermediary wallets.
The players
Triple-A
A financial technology company specializing in digital currency payments and treasury management solutions.
Tornado Cash
A decentralized, non-custodial privacy protocol built on Ethereum that masks the transaction history of digital assets.
The details
The attackers utilized Tornado Cash, a non-custodial privacy tool that uses zero-knowledge proofs—a cryptographic method that allows one party to prove a statement is true without revealing the underlying data—to obfuscate transaction origins. Before reaching the mixer, the stolen funds were bridged to the Ethereum network and consolidated into a single wallet. This follows a September 6, 2026, maneuver where the assets were split across two distinct intermediary addresses.
Timeline
July 2026: The initial security breach of the Triple-A treasury occurred.
September 6, 2026: The stolen assets were split across two intermediary wallet addresses.
October 9, 2026: Attackers executed 56 transactions to move 4,970 Ether into Tornado Cash.
The Tech Race
The use of Tornado Cash despite significant regulatory pressure follows a pattern of threat actors utilizing established privacy mixers to evade chain analysis. The persistence of these protocols in the face of international sanctions demonstrates the ongoing arms race between blockchain forensics firms and decentralized obfuscation tools.
This event serves as a reminder for users of digital asset platforms to verify the custody and security protocols of their service providers. While Triple-A stated that customer funds remained unaffected, the breach illustrates the persistent risks institutional treasuries face from sophisticated threat actors.
The takeaway
The laundering of $12.4 million in Ether illustrates the difficulty of reclaiming assets once they enter decentralized mixers. Watch for further forensic reports from blockchain security firms, which may provide updated attribution regarding the origin of these specific transaction patterns.
Further reading
For more on the methodologies used to track illicit digital asset flows, see our Cybersecurity section.
Live Poll
Should regulators place stricter limits on the use of cryptocurrency mixers like Tornado Cash?
