Pando Rings Hacker Moves 4,000 ETH Worth $9.2 Million Through Tornado Cash

A wallet linked to the 2022 Pando Rings exploit transferred 4,000 Ethereum (ETH), worth approximately $9.2 million, into Tornado Cash on November 2, 2026. Blockchain analytics firm Lookonchain flagged the transaction, which occurred nearly four years after the original attack. The transfer involved more than half of the 7,548 ETH recently acquired by the attacker.

The wallet previously exchanged approximately 16.98 million DAI for 7,548 ETH at an average price of $2,249 per token. Blockchain security firm PeckShield also identified earlier activity involving Aave, where the address deposited 16.8 million USDT and borrowed 5,000 ETH before repaying the loan. The original Pando Rings exploit occurred in November 2022, when attackers manipulated a price oracle vulnerability and stole approximately $20 million in cryptocurrency.

Tornado Cash allows users to obscure transaction histories by mixing cryptocurrency deposits. Consequently, the latest transfer complicates efforts to trace funds associated with the exploit. Approximately 3,548 ETH from the recent purchase remained outside the mixer following the reported transfer. However, investigators have not confirmed whether the attacker intends to sell those holdings. The movement highlights continuing challenges in tracking stolen cryptocurrency across decentralized finance platforms.