Triple-A attacker moves $12.4m in ETH to Tornado Cash

HACK OR EXPLOITTriple-A attacker moves $12.4min ETH to Tornado Cash26IMPORTANCECLOSED1NEWS MEDIA1PIECESOct 10, 2026 08:38blockboard.net

A wallet linked to Triple-A’s July treasury breach moved 4,970 ETH, worth about $12.4 million, into Tornado Cash. The transfers were tracked in October after the funds had been consolidated on Oct. 9. A blockchain security firm identified the activity as tied to the breach and said the ETH was split across dozens of deposits.

What this rests on

Claim by claim, with its source
✓
The wallet moved the ETH across 56 transactions after the funds were consolidated on Oct. 9.
✓
A wallet tied to Triple-A’s July treasury theft moved 4,970 ETH, valued at about $12.4 million, into Tornado Cash.
✓
Salus said its Tornado monitoring system tracked 49 deposits of 100 ETH and seven additional deposits in the same activity.
✓
Salus identified the sender as the attacker behind Triple-A’s July treasury breach.

What it means

Who it affects, what changes and what is still unconfirmed

Each sentence links inside to the piece that supports it.

Users and anyone following Triple-A’s treasury incident now see a large amount of ETH moved through Tornado Cash after the July breach. That makes the chain activity visible to the broader crypto sector and to monitors watching sanctioned or privacy-focused transfers.

What changed in practice is that the funds were consolidated on Oct. 9 and then sent out in 56 transactions, rather than appearing as one transfer. The underlying July theft remains the same event in the background, but the later movement shows a new transaction path for the same assets.

Market reaction

ET Ethereum the event is about this asset from 2 h before to 4 h after the line marks the first headline
published
-0.04 % before publication
+0.10 % after
$2,492price at publication
12series points

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 10 09:30
crypto.news scoop
Breaks the event: $12.4M

Thefts of a similar size

WhenWhat happenedFigure
12 months ago Berachain incident $12.8M
5.9 years ago Compounder Finance · Admin Drain incident $12.5M
1.7 years ago Ionic incident $12.3M
1.4 years ago Corkprotocol incident $12M
2.2 years ago Ronin incident $12M

4197 incidents stored · 280 were as large as this one or larger ($12.4M)

What could happen next

What the prediction markets currently price as likely. This is context, not a forecast of ours: there is money on it, and that is all we show.

1 % no series
Kalshi · $105,251 of open interest · resolves on Oct 11, 2026