Cash

Movement

ZachXBT

Tornado Cash

Tornado

Blockchain investigator ZachXBT has flagged suspicious on-chain activity involving 3,200 ETH reportedly withdrawn from Tornado Cash, with approximately $5.5 million subsequently bridged through Circle's Cross-Chain Transfer Protocol (CCTP).
The allegation centers on a hacker who allegedly used Ethereum's most prominent mixing service to obscure the origin of funds before moving a portion cross-chain via a stablecoin bridge. The claim remains partially verified, with no confirmed transaction hashes or wallet addresses publicly corroborated at the time of reporting. For related coverage, see <a href="https://coincu.com/sars-draft-crypto-tax-guidance-august-31-feedback-deadline/" rel="noopener noreferrer nofollow">SARS Draft Crypto Tax Guidance Sets August 31 Feedback Deadline</a>.
<h2 id="what-zachxbt-alleged-about-the-3-200-eth-movement">What ZachXBT Alleged About the 3,200 ETH Movement</h2>
ZachXBT, a pseudonymous on-chain sleuth known for tracking illicit crypto flows, identified what he described as a hacker moving 3,200 ETH out of Tornado Cash. The movement represents a significant sum and follows patterns commonly associated with exploit-related fund laundering.
The investigator has previously <a href="https://coincu.com/zachxbt-raises-concerns-over-high-premiums-at-bitcoin-depot-atms/" rel="noopener noreferrer nofollow">raised concerns about crypto infrastructure vulnerabilities</a>, and this latest flagging fits within his broader work tracking stolen funds across DeFi protocols.
It is important to note that the current evidence base for this specific claim is incomplete. No readable transaction evidence from <a href="https://etherscan.io/search?f=0&amp;q=3200%20ETH%20Tornado%20Cash%20Circle%20CCTP" rel="noopener noreferrer nofollow">Etherscan searches</a> has been independently confirmed to match the exact flow described. The allegation should be treated as under review pending further on-chain verification.
<h2 id="how-the-reported-circle-cctp-bridge-flow-could-have-worked">How the Reported Circle CCTP Bridge Flow Could Have Worked</h2>
According to the claim, approximately $5.5 million was bridged via Circle CCTP after the initial Tornado Cash withdrawal. Circle's Cross-Chain Transfer Protocol allows native USDC to be burned on one chain and minted on another, enabling cross-chain transfers without relying on wrapped tokens or traditional bridge liquidity pools.
The implied sequence suggests the hacker converted some portion of the withdrawn ETH into USDC, then used CCTP to move the stablecoins to a different blockchain. This two-step approach, mixing followed by bridging, complicates tracing efforts by splitting the fund trail across multiple chains.
The relationship between the 3,200 ETH figure and the $5.5 million bridged amount indicates that only a portion of the total was moved via CCTP. At current ETH valuations, 3,200 ETH would be worth substantially more than $5.5 million, suggesting either a partial conversion or that the bridging represents one leg of a broader dispersal strategy.
The exact path from Tornado Cash withdrawal to CCTP bridge execution still requires readable transaction evidence to confirm. No specific transaction hashes have been published in connection with this report.
<h2 id="why-tornado-cash-plus-cctp-routing-matters-for-crypto-security">Why Tornado Cash Plus CCTP Routing Matters for Crypto Security</h2>
The combination of a privacy mixer and a cross-chain bridge represents one of the more effective laundering patterns available on public blockchains. Tornado Cash severs the on-chain link between deposit and withdrawal addresses, while CCTP moves funds to an entirely different network.
For investigators, this layered approach creates multiple breakpoints in the tracing process. Similar patterns have been observed in previous cases where <a href="https://coincu.com/six-addresses-buy-12128-eth-transfer-to-tornado-cash/" rel="noopener noreferrer nofollow">large ETH amounts were transferred to Tornado Cash</a> following suspected exploits.
Security monitors tracking Ethereum-based exploits have increasingly noted that attackers combine mixer services with legitimate bridge infrastructure. The use of Circle's own protocol, rather than a less regulated bridge, adds a layer of complexity since CCTP transactions pass through Circle's attestation service.
This raises questions about whether bridge operators could implement screening on mixer-sourced funds. The broader implications for cross-chain investigations remain an active area of discussion among blockchain forensics teams, as demonstrated by cases like the <a href="https://coincu.com/specter-flags-suspected-mining-express-linked-address-swapping-5004-eth-for-8-8-million-dai/" rel="noopener noreferrer nofollow">suspected Mining Express ETH-to-DAI swap</a> flagged by other investigators.
<h2 id="what-remains-unverified">What Remains Unverified</h2>
The current research record for this report carries a partial verification status. No fully confirmed transaction trail has been established from publicly available data at the time of writing.
Key missing elements include specific wallet addresses involved in both the Tornado Cash withdrawal and CCTP bridge transaction, transaction hashes that would allow independent verification on <a href="https://goto.etherscan.com/rd/V1FU4H4F7PC1VI6MSG1UZWJ3H" rel="noopener noreferrer nofollow">Etherscan</a>, and a direct link to ZachXBT's original post containing the allegation.
The article uses cautious attribution language throughout because the verified facts supporting the headline claim could not be independently confirmed through available on-chain data. Readers should treat this as an unconfirmed allegation from a credible but single source until additional evidence emerges.
Cases involving <a href="https://coincu.com/vietnamese-police-asset-seizures-bank-account-freezes-onus-crypto-fraud-case/" rel="noopener noreferrer nofollow">crypto fraud investigations</a> often develop over days or weeks as investigators publish follow-up findings, and additional details about this specific movement may surface in subsequent disclosures.
<h2 id="faq-about-zachxbt-tornado-cash-and-circle-cctp">FAQ About ZachXBT, Tornado Cash, and Circle CCTP</h2>
Who is ZachXBT?
ZachXBT is a pseudonymous blockchain investigator who tracks illicit fund flows, scams, and exploits across crypto protocols. He has built a reputation for identifying and publicly flagging suspicious wallet activity, often before formal law enforcement actions occur.
What is Tornado Cash?
Tornado Cash is an Ethereum-based mixing protocol that breaks the on-chain link between sender and receiver addresses. Users deposit tokens into a pool and later withdraw from a different address, making it difficult to trace the origin of funds through standard blockchain analysis.
What does Circle CCTP do?
Circle's Cross-Chain Transfer Protocol enables native USDC transfers between supported blockchains. Unlike traditional bridges that lock and mint wrapped tokens, CCTP burns USDC on the source chain and mints an equivalent amount on the destination chain through Circle's attestation process.
Why are 3,200 ETH and $5.5 million notable figures?
A movement of 3,200 ETH from a mixing service represents a large single withdrawal that typically signals exploit-related laundering rather than routine privacy usage. The $5.5 million bridged via CCTP suggests a deliberate cross-chain dispersal strategy designed to complicate fund recovery efforts.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post <a href="https://coincu.com/zachxbt-hacker-moved-3200-eth-tornado-cash-5-5m-circle-cctp/" rel="noopener noreferrer nofollow">ZachXBT Flags 3,200 ETH Tornado Cash Move and $5.5M CCTP Bridge</a> was initially published on <a href="https://coincu.com/" rel="noopener noreferrer nofollow">Coincu</a>.

ZachXBT Flags 3,200 ETH Tornado Cash Move and $5.5M CCTP Bridge

Table of Contents

Coincu

Other articles published on Jul 5, 2026

Join our free newsletter for daily crypto updates!