The attacker behind Triple-A's July treasury breach has transferred 4,970 ETH worth approximately $12.4 million into Tornado Cash on October 9, according to blockchain security firm Salus. The funds entered through 56 deposits of varying sizes, with Salus tracking 49 deposits of 100 ETH and seven deposits of 10 ETH linked to the attacker. As reported by Salus, the attacker combined funds from two intermediary addresses through a single wallet before making the Tornado Cash deposits. The hack occurred on July 27, resulting in total losses of approximately $11.8 million from the stablecoin payment infrastructure compromise.
According to Salus, the attacker used a wallet that had previously moved assets across blockchains to Ethereum, exchanged the tokens, and divided the funds between two addresses on September 6. The security firm's transaction breakdown shows 4,900 ETH in the 49 larger deposits and 70 ETH in the seven smaller deposits. The attacker later routed both streams through a single address before depositing the Ether into Tornado Cash, with one stream including funds from earlier withdrawals from the mixer. One of these funding paths notably reused previously mixed funds, demonstrating the sophisticated nature of the attacker's money laundering operations.
Triple-A confirmed the July breach affected company treasury assets while customer funds remained untouched. The company attributed the attack to social engineering and engaged specialists to trace the stolen assets. According to Triple-A's official statement, the company detected unauthorized access on July 25 and temporarily placed certain services into maintenance mode for approximately three hours while securing the affected infrastructure. The company stated it remains well capitalized and able to meet all liabilities, with customer funds held separately in trust accounts maintained with safeguarding institutions.
In its August 21 post-mortem, Triple-A said the attack began with social engineering against an engineering employee involving impersonation, communications across different channels, and a live call. After compromising credentials, the attacker obtained elevated system permissions, deployed malware, accessed production databases, and abused API credentials to execute cryptocurrency withdrawals. The company engaged Sygnia for forensic work and zeroShadow for asset tracing, while notifying the Monetary Authority of Singapore and Singapore police immediately after detecting the incident. The breach highlights ongoing vulnerabilities in cryptocurrency infrastructure and the continued exploitation of such systems by sophisticated attackers.
