Key Highlights
- About $27.3 million in crypto was stolen from a compromised multi-signature wallet, and the hacker appears to have full control of it.
- Most of the stolen Ethereum has been sent through Tornado Cash, with around 6,300 ETH already deposited to hide the transaction trail.
- The hacker is actively using DeFi, holding a leveraged position on Aave worth about $9.75 million, which could be liquidated if prices move sharply.
A hacker who broke into a multi-signature crypto wallet earlier this week is now actively laundering the stolen funds, according to blockchain security firm PeckShield. The attack involved about $27.3 million in digital assets and was detected through on-chain activity.
In an X post on Tuesday, PeckShield said the attacker did not just enter the wallet for a short time. Instead, the hacker appeared to have full control of the wallet and laundered the funds over several steps.
According to on-chain data as shown by PeckShield, most of the stolen Ethereum has already been sent through Tornado Cash, a privacy-focused protocol that makes transactions harder to trace. PeckShield reported that around 6,300 ETH, worth about $19.4 million, has been deposited into the mixer so far. The hacker reportedly sent ETH in “multiple batches” to the privacy service.
Hacker actively uses DeFi platforms
The attacker has also interacted with decentralized finance platforms. PeckShield confirmed that 1,000 ETH, worth about $3.24 million, was withdrawn from Aave and later sent through Tornado Cash. In addition, the hacker currently holds an active leveraged position on Aave V3. Data shows that around $20.5 million in wrapped Ether has been placed as collateral against more than $10.7 million in borrowed DAI.
According to PeckShieldAlert, the open position has a total value of about $9.75 million and a health factor of 1.58. This means the position remains active but could face liquidation if market prices shift sharply. While the funds are being used for trading, the original loss to the wallet’s owners remains unchanged.
Also Read: Unleash Protocol Exploit: $3.9M Stolen via Multisig Governance Breach
