CertiK Flags Nearly $1M Transfer to Tornado Cash from CoinStats Exploit

Wallets linked to the CoinStats exploiter recently moved almost $1 million in Ether into the controversial crypto mixing protocol Tornado Cash.

The latest development comes less than a week after the leading crypt tracker said that investigations are underway.

Tornado Cash Inflow

Blockchain security firm CertiK flagged that two wallets associated with the CoinStats exploit in June transferred 311 ETH, valued at approximately $959,000, to Tornado Cash. One wallet moved 211 ETH, while the other transferred 100 ETH to the crypto mixer.

CoinStats reported a security breach on June 22nd affecting iOS users who received a misleading notification offering a reward. The company swiftly suspended its application to contain the breach and confirmed that the attack was managed, impacting just 1.3% of their total wallets – 1,590 in total. CoinStats also assured users that connected wallets and centralized exchanges (CEXes) remained secure.

In a more recent update on July 5th, the company said that the incident is still under investigation but did not disclose any further details on whether law enforcement authorities have been roped in.

“We are still investigating the security incident on June 22 and taking rapid and committed actions to ensure the security of our new infrastructure. We are working hard to share additional information as soon as we can, including measures to support any victims.”

Tornado Cash Devs’ Legal Firestorms

Despite facing legal challenges and significant crackdowns, Tornado Cash continues to be widely used for laundering stolen funds. In August 2022, the US Department of the Treasury blacklisted the service, prohibiting its use by US citizens, residents, and companies. The project’s web domain and GitHub accounts were shut down.

Later that month, Tornado Cash developer Alexey Pertsev was arrested in Amsterdam on suspicion of involvement in concealing criminal financial flows and facilitating money laundering through the Ethereum mixing service. Pertsev was sentenced to 5 years and 4 months in prison last May.

A few months later, two more Tornado developers, Roman Storm, and Roman Semenov, were charged with aiding $1 billion in money laundering. The former was arrested in Washington State.