Aztec Bridge Exploiter Moves Additional 300 ETH to Tornado Cash

Blockchain security firm PeckShield first flagged the transactions on August 8, detailing three separate transfers of 100 ETH each. These assets originate from an exploit that drained approximately $2.165 million from the Aztec bridge, a legacy product that the company maintains is disconnected from its current network infrastructure and the AZTEC token.

The attacker’s strategy mirrors a broader trend in decentralized finance, where exploiters leverage the obfuscation features of Tornado Cash to obscure the trail of illicitly obtained assets. This specific incident follows a June surge in security breaches, during which DefiLlama recorded nearly $75 million in total losses across the industry. While the U.S. Treasury recently removed Tornado Cash from its formal sanctions list following a federal court ruling, the mixer remains a primary focus of investigations into money laundering and cybercrime.

Because the affected Aztec contract was immutable and lacked administrative keys, the project team could not intervene to halt the theft or patch the underlying vulnerability. With only 500 ETH moved so far, investigators are monitoring the wallet to see if the remaining stolen assets—which included DAI and renBTC—will follow a similar path into mixing services.