Triple-A Treasury Hacker Launders $12.4 Million Through Tornado Cash

On October 9, the attacker completed 56 separate deposits into the privacy protocol, consisting of 49 transactions of 100 ETH each and seven smaller 10 ETH deposits. Blockchain analysis reveals a complex path: the perpetrator moved the stolen funds across multiple chains, performed asset swaps, and split the capital into two intermediary wallets before consolidating them into a single address for the final mixer deposit. This activity marks a significant movement in a case that originated in July when Triple-A confirmed that unauthorized parties had compromised its Singapore-based infrastructure.

Triple-A previously disclosed that the breach, which targeted company reserves rather than client deposits, was facilitated by a social engineering campaign against an engineering employee. By impersonating trusted parties and gaining access to credentials, the attacker deployed malware to siphon funds from wallets across the TRON, Ethereum, Polygon, and Arbitrum networks. While the firm initially estimated losses at $11.8 million, the current market value of the laundered Ether sits at approximately $12.4 million. In response, the payments company has engaged forensic specialists, including Sygnia and zeroShadow, to trace the assets and bolster internal security protocols.