The Laundering Process
Published 6/21/2026, 7:46:56 AM
Tornado Cash launders stolen ETH by severing the on-chain link between the source of funds (the exploit wallet) and the destination (a fresh wallet) using zero-knowledge proofs (zk-SNARKs). Attackers utilize fixed-denomination pools and a network of "relayers" to ensure that the new withdrawal address has no prior transaction history or funding link to the original stolen assets.
The Laundering Process
The laundering cycle typically follows a four-stage technical process:
- Deposit (The Taint): The attacker sends stolen ETH to a Tornado Cash smart contract. Upon deposit, they generate a private "note" (a cryptographic secret) and a corresponding commitment hash that is stored on-chain [Source: https://coinmarketcap.com/community/article/tornado-cash-technical-deep-dive-and-regulatory-outlook].
- Mixing (The Wait): The funds are pooled with other users' deposits. Attackers often wait for days or weeks to increase the "anonymity set," making it harder for analysts to use timing analysis to link a specific deposit to a specific withdrawal.
- Withdrawal (The Clean): The attacker provides a zk-SNARK proof to the contract. This proof demonstrates they possess a valid secret for a deposit in the pool without revealing which deposit it is [Source: https://docs.tornadocash.eth.link/].
- Relayer Execution: To prevent the new withdrawal address from needing "gas money" (which would create a traceable link), a third-party Relayer submits the transaction. The relayer pays the gas fee and deducts it from the withdrawn ETH, allowing the attacker to receive "clean" funds in a completely fresh wallet.
Major Laundering Incidents (2024–2026)
Attackers frequently use these pools to move hundreds of millions of dollars from high-profile exploits.
| Incident | Date | Amount Laundered | Attributed Actor |
|---|---|---|---|
| Drift Protocol Exploit | April 2026 | $285 million | Lazarus Group |
| HTX/HECO Bridge Hack | March 2024 | $100 million+ | Lazarus Group |
| Verus-Ethereum Bridge | 2026 | $11.5 million | Unknown |
| TOP Governance Takeover | June 2026 | $2.7 million | Governance Attacker |
Technical Obfuscation Techniques
Beyond the protocol itself, sophisticated actors layer additional techniques to further hide the trail:
- Fixed Denominations: By using standard pools (e.g., 10 ETH or 100 ETH), attackers ensure their transactions look identical to thousands of others, preventing amount-based tracking.
- Multiple Hops: After withdrawal, funds are often moved through a series of unconnected wallets or cross-chain bridges before being sent to centralized exchanges with weak KYC (Know Your Customer) requirements.
- Governance Attacks: In some cases, laundered ETH is used as "seed capital" to buy governance tokens and seize control of other protocols, as seen in the TOP Governance Takeover where 664 ETH (~$2.7M) was used to take control [Note: not independently confirmed].
Regulatory Status
Tornado Cash was sanctioned by the U.S. OFAC in August 2022 for facilitating over $7 billion in money laundering. While some legal challenges led to a partial lifting of certain sanctions in March 2025, the protocol remains a primary tool for state-sponsored actors like the Lazarus Group.
In summary, the attacker uses Tornado Cash to transform "tainted" ETH into "clean" ETH by using cryptographic proofs to hide the transaction path, effectively resetting the asset's on-chain history.
Next Steps:
- Would you like to perform a technical analysis on a specific wallet address to check for interactions with Tornado Cash or other mixers?
- I can monitor the Drift Protocol exploit wallets for any new movement or further laundering activity.