Aave

Cash

Tornado Cash

TRON

Tornado

The perpetrator behind the December 18 $27.3 million cryptocurrency theft has withdrawn 1,000 ETH worth $3.24 million from the DeFi platform Aave and laundered it through Tornado Cash.
According to PeckShield, the attacker has now funneled up to 6,300 ETH, valued at $19.4 million, through Tornado Cash since the initial breach.
PeckShield <a href="https://x.com/PeckShieldAlert/status/2008471690175758715" target="_blank" rel="noopener noreferrer nofollow">wrote on X</a>, “The drainer, who controls the compromised multisig, holds a $9.75M leveraged long position ($20.5M in ETH against $10.7M in DAI).”
<h3 id="span-pig-butchering-span-scam-emerges-i-span-n-mo-span-ney-span-trail-span">Pig-butchering scam emerges in money trail</h3>
Another incident involving laundering and the use of <a href="https://www.cryptopolitan.com/ethereum-foundation-commit-to-tornado-cash/" rel="noopener noreferrer nofollow">Tornado Cash</a> has caught the eye of on-chain monitors.
<a href="https://x.com/SpecterAnalyst/status/2008132286550544686" target="_blank" rel="noopener noreferrer nofollow">On-chain analyst Specter</a> notified the public on X, stating, “A wallet bridged $7M to Ethereum from multiple wallets on the TRON blockchain. Tracing the funds suggests they originate from a crypto investment pig-butchering scam.”
PeckShield also corroborated the story with on-chain data, uncovering a laundering operation that is related to pig butchering.
<a href="https://x.com/PeckShieldAlert/status/2008433323501371592" target="_blank" rel="noopener noreferrer nofollow">PeckShield </a><a href="https://x.com/PeckShieldAlert/status/2008433323501371592" target="_blank" rel="noopener noreferrer nofollow">analysis</a> indicated that one address alone had processed 2,479.1 ETH worth $7.9 million through Tornado Cash, with funds traced back to multiple Tron wallets before being bridged to Ethereum.
The attacker’s methodical approach involves depositing funds in 100 ETH batches into Tornado Cash, which severs the blockchain links between deposits and withdrawals, making recovery efforts more difficult.
Another incident highlighted by PeckShield the same day was the one where a “UXLink exploiter labeled address has swapped 248 $WBTC for 23M $DAI within the last hour.”
The on-chain security firm <a href="https://x.com/PeckShieldAlert/status/2008477054241808740" target="_blank" rel="noopener noreferrer nofollow">added</a> that “This follows the Sept. 22 hack, where the attacker minted billions of unauthorized tokens and drained tens of millions in crypto assets.”
<h3 id="span-crypto-span-industry-span-grapples-span-with-span-losses-span">Crypto industry grapples with losses</h3>
The December theft forms part of an increasing pattern of crypto breaches that saw over $117.8 million lost to exploits, according to industry data. In November 2025, around $127 million was lost, with about $45 million frozen or recovered from that loot, according to data from <a href="https://x.com/CertiKAlert/status/2006335529579938004" target="_blank" rel="noopener noreferrer nofollow">cybersecurity firm Certik</a>.
December saw several significant incidents, including a $50 million <a href="https://www.cryptopolitan.com/crypto-investor-hit-by-50m-usdt-scam/" rel="noopener noreferrer nofollow">address poisoning attack</a> and the exploit of Trust Wallet’s browser extension that saw losses run up to over $8.5 million.
A recent <a href="https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/#:~:text=The%20big%20picture:%20Over%20$3.4,$1.5%20billion%20of%20that%20total." rel="noopener noreferrer nofollow" target="_blank">Chainalysis report</a> pointed out that the top ten cryptocurrency hacks of 2025 resulted in a combined loss that exceeded $2.2 billion of the $3.4 billion that was stolen in the crypto industry. The report came out before the Trust Wallet exploit later in December.
The December breach ranks among the year’s most significant private key compromises, a category of attack that security experts consider devastating due to the complete control it grants perpetrators.
Phishing and wallet compromises ranked first and second by category in terms of the amount lost to breaches in December. Despite ongoing monitoring by blockchain security firms, no recovery efforts have been announced.
The attacker’s leveraged position on Aave presents more challenges to an already complicated issue, as liquidation of the collateral could trigger market movements. However, it will also provide opportunities for tracking if the perpetrator attempts to extract value.
The smartest crypto minds already read our newsletter. Want in? <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" target="_blank" rel="noopener noreferrer nofollow">Join them</a>.

The hacker behind the $27.3 million multisig wallet breach has begun liquidating funds

Table of Contents

Cryptopolitan_News

Other articles published on Jan 6, 2026

What Happens Next For Cardano After 21% Weekly Surge Meets Cooling Momentum?

Web3 Games Enter 2026 With Treeverse, emoji™, Hive Invasion

USDT on TRON Gets Regulatory Green Light in Abu Dhabi

Gate Ventures Outlook for 2026: Five Trends Reshaping Crypto

The $7M Trust Wallet Extension Hack: All You Need to Know

Lighter Protocol Launches LIT Token with Community Airdrop

Join our free newsletter for daily crypto updates!