Cash

Ethereum

Million

Tornado Cash

Tornado

<p>Blockchain security company <a href="https://x.com/CertiKAlert/status/2003386348284313985" target="_blank" rel="noopener noreferrer nofollow">CertiK has issued</a> an important warning after detecting a suspicious on-chain incident that led to the loss of nearly $2.3 million in digital assets.</p>
<p>According to CertiK, the suspicious activity was found using its Skylens monitoring system, which tracks unusual movements on the blockchain.</p>
<h2 class="wp-block-heading" id="h-how-the-2-3-million-crypto-hack-happened">How the $2.3 Million Crypto Hack Happened</h2>
<p>According to the <a href="https://etherscan.io/tx/0x01c82376cd3498863437c7cd36330555ef1381db6b80cc5803e675a2a4bb6c7b" target="_blank" rel="noopener noreferrer nofollow">CertiK report</a>, there were two wallets involved in the attack. One wallet sent around $1.8 million, while the second wallet sent about $506,000. Both transfers went to the same unknown wallet, which was later marked as malicious.&nbsp;</p>
<p>This means the money was likely stolen, not sent by choice.</p>
<p>After receiving the stolen money, the attacker quickly moved the funds into Tornado Cash, a crypto privacy tool. Tornado Cash is often used to hide transaction trails, making it very hard to track or recover stolen funds.</p>
<figure class="wp-block-image size-full">
 <img width="680" height="337" src="https://image.coinpedia.org/wp-content/uploads/2025/12/23165438/image-65.jpeg" alt="onchain data">
</figure>
<p>Blockchain data shows multiple Ethereum transfers, including small and large amounts like 10 ETH and 100 ETH, being sent through Tornado Cash within minutes. This fast movement is a common sign of a planned attack.</p>
<h2 class="wp-block-heading" id="h-the-victim-asks-for-negotiation">The Victim asks for Negotiation</h2>
<p>What makes this case unusual is what happened next. CertiK’s data shows that both compromised wallets sent an on-chain message to the receiving address, asking whether negotiation was possible.&nbsp;</p>
<figure class="wp-block-image size-full">
 <img width="680" height="196" src="https://image.coinpedia.org/wp-content/uploads/2025/12/23165438/image-64.jpeg" alt="msg to attacker">
</figure>
<p>This suggests the transfers were not intentional trades, but likely the result of a security breach where wallet access was lost.</p>
<h2 class="wp-block-heading" id="h-sharp-warning-for-crypto-users">Sharp Warning For Crypto Users</h2>
<p>This incident once again highlights the growing risks around wallet security. Even without smart contract exploits, attackers can drain funds using compromised private keys, phishing links, or malicious approvals.</p>
<p>Meanwhile, some experts have started closely monitoring and flagging the wallet address, even though recovering the stolen funds may not be possible.”</p>
<h2 class="wp-block-heading" id="h-faqs">FAQs</h2>
<div class="schema-faq wp-block-yoast-faq-block">
 <div class="schema-faq-section" id="faq-question-1766493042266">
  <strong><strong>Who is most affected by incidents like this, and why does it matter beyond the victim wallets?</strong></strong>
  <p>Retail users, traders, and protocols interacting with compromised wallets can face indirect losses if funds move through shared platforms. Such incidents also undermine confidence in self-custody, a core principle of crypto adoption.</p>
 </div>
 <div class="schema-faq-section" id="faq-question-1766493060957">
  <strong><strong>Can exchanges or authorities intervene once funds enter a privacy mixer?</strong></strong>
  <p>Once assets pass through a mixer, tracing becomes significantly harder, limiting the ability of exchanges or law enforcement to freeze funds. Intervention is most effective before mixing occurs.</p>
 </div>
 <div class="schema-faq-section" id="faq-question-1766493076437">
  <strong><strong>What happens next after an on-chain incident is publicly flagged?</strong></strong>
  <p>Security firms and analysts continue monitoring related addresses for future movements. The affected parties often rotate wallets, review access points, and strengthen operational security to prevent repeat breaches.</p>
 </div>
</div>

Crypto Hack: CertiK Warns After $2.3 Million Stolen Fund Sent To Tornado Cash

Table of Contents

CoinPedia News

Other articles published on Dec 23, 2025

Join our free newsletter for daily crypto updates!