Cash

Ethereum

Tornado Cash

Security

Tornado

<ul>
 <li>CertiK uncovers silent wallet breach as $2.3M vanishes through Tornado Cash</li>
 <li>Hackers bypass smart contracts, drain wallets, and erase trails within minutes</li>
 <li>On-chain messages expose panic as victims seek negotiation after funds disappear</li>
</ul>
Crypto security concerns intensified after blockchain investigators uncovered a coordinated theft worth nearly $2.3 million. <a href="https://x.com/CertiKAlert/status/2003386348284313985" target="_blank" rel="noopener noreferrer nofollow">The alert came from CertiK</a>, which identified unusual wallet activity through its Skylens monitoring infrastructure. The case has drawn attention because it bypassed smart contracts entirely. 
Investigators observed abnormal transfers originating from two separate wallets. One wallet moved close to $1.8 million in digital assets. Another wallet transferred roughly $506,000. Both transactions flowed into the same unidentified address, which analysts later classified as malicious. The pattern suggested deliberate fund extraction rather than routine trading activity. 
Shortly after receiving the assets, the attacker initiated rapid fund movements. The stolen crypto passed through Tornado Cash, a service known for obscuring transaction trails. Blockchain data recorded multiple Ethereum transfers within minutes, including chunks of 10 ETH and 100 ETH. 
Such speed often reflects prior planning rather than spontaneous action. The laundering step significantly reduced recovery chances. Privacy mixers disrupt traceability, limiting investigative options once assets enter the pool. Security teams, therefore, shifted focus toward attribution and risk warnings rather than retrieval. 
Also Read: <a href="https://36crypto.com/arizona-lawmakers-move-to-strip-state-taxes-from-cryptocurrency-activities/" target="_blank" rel="noopener noreferrer nofollow">Arizona Lawmakers Move to Strip State Taxes From Cryptocurrency Activities</a> 
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 <a href="https://twitter.com/hashtag/CertiKInsight?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#CertiKInsight</a> <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" style="height: 1em; max-height: 1em;"> 
 Our alert system has detected suspicious transactions leading to the loss of ~$2.3M. 
 Wallets 0xaac and 0x120 respectively transferred ~$1.8M and ~506K to a malicious address 0x530.<a href="https://t.co/GDUBE2Vqu9" rel="noopener noreferrer nofollow">https://t.co/GDUBE2Vqu9</a> 
 — CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/2003386348284313985?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">December 23, 2025</a> 
 </blockquote>
 
</div>
<h2 id="wallet-messages-reveal-loss-of-control">Wallet Messages Reveal Loss of Control</h2>
The incident took a notable turn after the laundering phase. On-chain records showed both affected wallets sending messages directly to the receiving address. The messages requested possible negotiation over the transferred funds. 
This behavior indicated the wallet owners did not authorize the transactions. Security analysts highlighted that negotiation attempts typically follow account takeovers. Victims often resort to blockchain messages when traditional recovery methods fail. The evidence pointed toward compromised private keys or deceptive approval attacks. 
Further review <a href="https://36crypto.com/suspected-243m-crypto-hacker-arrested-after-major-breakthrough-in-global-heist/" target="_blank" rel="noopener noreferrer nofollow">showed no signs of protocol</a> failure or smart contract misuse. Instead, the breach aligned with growing trends involving phishing links, fake signature requests, and malicious permissions. These techniques allow attackers to drain wallets silently once access is granted. 
The malicious address has since been flagged by monitoring platforms. Analysts continue tracking activity linked to the wallet, despite limited expectations of asset recovery. Early warnings remain the primary defense once funds reach privacy infrastructure. 
The event underscores a broader shift in attack strategies. Hackers increasingly target individuals rather than protocols. Wallet security practices now matter as much as contract audits. Reviewing approvals, avoiding unknown links, and safeguarding private keys remain critical. 
This case serves as another reminder that decentralized systems offer freedom alongside responsibility. As attackers refine their methods, vigilance remains the strongest line of defense. 
Also Read: <a href="https://36crypto.com/bitcoin-activity-slumps-as-on-chain-data-signals-deep-bear-market-pressure/" target="_blank" rel="noopener noreferrer nofollow">Bitcoin Activity Slumps as On-Chain Data Signals Deep Bear Market Pressure</a> 
The post <a rel="noopener noreferrer nofollow" href="https://36crypto.com/certik-flags-2-3m-crypto-theft-as-hackers-vanish-funds-through-tornado-cash/">CertiK Flags $2.3M Crypto Theft as Hackers Vanish Funds Through Tornado Cash</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://36crypto.com">36Crypto</a>.

CertiK Flags $2.3M Crypto Theft as Hackers Vanish Funds Through Tornado Cash

Table of Contents

36crypto

Other articles published on Dec 23, 2025

Join our free newsletter for daily crypto updates!