In this article5 sections
The attacker behind the 2022 Pando Rings exploit deposited 4,000 ETH into Tornado Cash and left 3,548 ETH outside the mixer, according to on-chain data reported by AMBCrypto. The transfers, dated to the end of October and reported on November 2, mark the exploiter’s renewed effort to hide stolen funds four years after the breach.
AMBCrypto, citing Arkham data, described a sequence in which the wallet first converted about $16.98 million in Dai to 7,548 ETH, then split the balance into smaller 100 ETH deposits worth roughly $229,000 each.
Also read: Crypto Market Today: Bitcoin Steady Near $86.1K as Cardano Jumps 11%
Key facts
- The attacker supplied 16.8 million USDT as collateral to borrow 5,000 ETH, repaid the loan, withdrew the collateral and swapped 16.7 million DAI for 7,548 ETH.
- After the conversions, 4,000 ETH went into Tornado Cash while 3,548 ETH stayed outside the mixer.
- Deposits were made in 100 ETH batches, each worth about $229,000, following an earlier 800 ETH deposit in August.
- AMBCrypto reported no confirmed exchange deposits and no established immediate selling pressure.
- Separately, Bitcoin.com News reported the Binance hacker split 233.46 million stolen XRP, worth about $293 million, across six new wallets between 03:52 and 04:00 UTC on Nov. 2.
How the funds were consolidated before the mixer
The attacker used Aave to turn stablecoin holdings into ETH before moving funds toward Tornado Cash. The lending step let the exploiter borrow ETH against USDT collateral, repay the loan, and then swap DAI for ETH, consolidating the balance into a single asset ahead of laundering.
That pattern matters for investigators because it breaks the link between the original stablecoin haul and the ETH that later entered the mixer. Rather than moving stolen tokens directly, the exploiter converted them through a lending market and a swap, adding layers that must be traced separately.
Why Tornado Cash complicates recovery
Tornado Cash pools deposits from many users and returns funds to fresh wallet addresses, cutting the direct connection between a depositor and later recipients. For theft recovery, that means wallet-level tracking of addresses tied to the hack yields less, and investigators must instead rely on transaction patterns and off-chain intelligence to establish where ETH eventually lands.
AMBCrypto reported that the latest deposits had not yet produced connections to wallets in known clusters. The exploiter’s August deposit of 800 ETH shows the mixer strategy predates the current transfers, so the approach is established rather than new.
Bitcoin.com News offered a parallel case that shows both the limits and the value of tracing. The Binance attacker moved all 233.46 million stolen XRP into six new wallets, five holding about 40 million XRP each and the sixth 33.46 million, after test payments of 1,000 XRP. That outlet also reported about $242 million already routed through Tron-related paths, including Relay, Thorchain, Chainflip and Symbiosis, and a $250,000 deposit into the exchange Gate. Native XRP has no issuer able to freeze it, in contrast to stablecoins, where Tether froze about 378.7 million USDT.
Why it matters
For holders and exchanges, the Pando Rings case shows that an exploit four years old can still produce fresh laundering activity, which keeps recovery efforts open but unresolved. There is no evidence in the reported data that the ETH has reached a trading venue, so the transfers do not by themselves establish new selling pressure on Ethereum.
The two stories differ in what has been confirmed. AMBCrypto reported no exchange deposits from the Pando Rings funds; Bitcoin.com News reported exchanges watching six labelled wallets and a small test deposit at Gate. Both outlets describe tracing as the main remaining lever once funds enter a mixer or are split across new addresses.
What to watch
The next concrete signal will be whether any of the 3,548 ETH left outside Tornado Cash moves toward an identifiable exchange deposit address, and whether the 4,000 ETH already mixed surfaces in wallets tied to known clusters. Until then, the recovery status of the Pando Rings funds stays unconfirmed.
Reported by AMBCrypto.
Sources: AMBCrypto, Bitcoin.com News