Mixin

Tornado

Tornado Cash

Pando

Cash

<p><strong></strong></p><strong><p><strong>The wallet associated with the 2022 Pando Rings oracle hack was <a href="https://x.com/OnchainLens/status/2089505052243468606" rel="noopener noreferrer nofollow">reactivated on August 18</a> after two months of inactivity, as reported by blockchain tracker Onchain Lens, The hacker exchanged 3 million DAI for about 1,570 ETH, worth approximately three million dollars, through CoW Protocol. Approximately 800 ETH worth around 1.52 million are known to have already reached Tornado Cash via eight transactions from this wallet.</strong></p><p>Although the action itself may be comparatively minor, the history of the event is anything but. Nearly four years after the incident in which a price feed was manipulated to drain Pando Rings, the fraudster is continuing to move the money, which can still be traced back to the original fraud. Once a serious cause of losses in DeFi, oracle manipulation has been effectively eliminated from occurring frequently due to improvements in protocol development.</p><h3 class="wp-block-heading" id="an-oracle-that-misread-its-own-collateral">An oracle that misread its own collateral</h3><p>On November 5, 2022, Pando Rings was <a href="https://pando.im/news/2022/2022-11-06-alert-to-pando-community-hack-of-pando-rings/" rel="noopener noreferrer nofollow">hacked</a>. The hacker was able to change the price of the sBTC-WBTC liquidity provider token at 4swap, which is Pando’s automated market maker, and used this price manipulation in an attempt to pull out $70 million worth of crypto. By the time the team took action, around $21.9 million worth of ETH, EOS, and BTC had already flown out of two Mixin wallets controlled by the hacker.</p><p>Some assets were not lost. Pando collaborated with Mixin Network and cybersecurity firm SlowMist to lock the rest of the funds. The frozen assets include 2,022,662 EOS coins that were worth approximately $2.36 million, as well as other tokens with a total valuation surpassing $50 million. The company discontinued its services, namely Pando Rings, 4swap, Pando Leaf, and Pando Lake, until the oracle is fixed, and they assured to reimburse all customers.</p><h3 class="wp-block-heading" id="from-buying-the-dip-to-reaching-for-the-mixer">From buying the dip to reaching for the mixer</h3><p>The same address has reemerged at intervals since that time. According to a Lookonchain report published on June 6, the same person conducted a transaction worth 10 million DAI to buy a total of 6,243 ETH at an average price of $1,602. It was then added that “even the hacker is <a href="https://x.com/lookonchain/status/2063107990035873950" rel="noopener noreferrer nofollow">buying the $ETH dip</a>.”</p><p>The purchase that took place and this week’s swap indicates a well-known strategy: turning stolen stablecoins into Ether when the time is right, and waiting for the best moment to move on. What has changed on August 18 is the final location. Instead of remaining in possession of the Ether token, the criminal started sending the Ether through Tornado Cash, a service that is used to conceal the connection between deposited and withdrawn funds. As of now, the amount of mixer deposits stands at 800 Ether, made in eight transactions.</p><h3 class="wp-block-heading" id="why-mixed-funds-stay-visible">Why mixed funds stay visible</h3><p>Even if a person sends money via Tornado Cash, that does not mean the trail will be lost. TRM Labs <a href="https://www.trmlabs.com/resources/blog/the-top-takeover-tornado-cashs-latest-chapter" rel="noopener noreferrer nofollow">tracked the attack</a> in June in which a person withdrew around 664 ETH from Tornado Cash and used it to take control of a small Ethereum protocol project known as TOP. This case reveals how mixer operations may still signal risk even if the direct transaction trail is difficult to follow.</p><p><br></p>
 <figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet">
    <p>Track this hacker at: <a href="https://t.co/BzkSa9GenR" rel="noopener noreferrer nofollow">https://t.co/BzkSa9GenR</a></p>— Onchain Lens (@OnchainLens) <a href="https://x.com/OnchainLens/status/2089505052650340506?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">August 18, 2026</a>
   </blockquote>
  </div>
 </figure><p></p><p>The legal standing of Tornado Cash has altered. While being <a href="https://home.treasury.gov/news/press-releases/jy0916" rel="noopener noreferrer nofollow">sanctioned</a> by US Treasury in August 2022, it was <a href="https://home.treasury.gov/news/press-releases/sb0057" rel="noopener noreferrer nofollow">taken off the sanctions list</a> on March 21, 2025, due to the federal appeal court’s ruling that immutable smart contracts cannot be classified as “property” subject to sanctioning legislation. Its use as an Ethereum mixer means that big transfers going through the protocol would attract some attention instead of just disappearing.</p><h3 class="wp-block-heading" id="a-protocol-winding-down-as-its-attacker-moves">A protocol winding down as its attacker moves</h3><p>The timing is interesting. Just three days prior to the wallet’s activity, Pando <a href="https://pando.im/news/2026/2026-08-15-pando-protocol-sunset-and-service-transition/" rel="noopener noreferrer nofollow">announced</a> on August 15 that it was discontinuing the protocol and putting its DeFi products into its maintenance mode under the supervision of Mixin. At this point, Pando Rings only serves to support the repayment of loans and the withdrawal of collateral.</p><p>In the meantime, incidents like that of Pando are no longer common. Immunefi’s six-year loss analysis found that <a href="https://immunefi.com/blog/research/the-ecosystem-vulnerability-scoreboard-6-years-of-defi-loss-data/" rel="noopener noreferrer nofollow">ecosystem-type attacks</a>, such as flash-loan oracle manipulation, dropped from almost 19% of DeFi loss incidents in 2022 to less than 1% in 2025.</p><p>As a result, the Pando exploiter is a remnant of an older time in DeFi security, still profiting from a weakness that the industry as a whole has been able to engineer around while using blockchains.</p><h3 class="wp-block-heading" id="broader-security-angle">Broader security angle</h3><p>The timing of Pando’s Aug. 15 announcement that it was sunsetting the protocol is worth investigating alongside the exploiter’s renewed activity. This isn’t simply an old 2022 hack resurfacing. It illustrates the long tail of DeFi exploits, where stolen assets can remain dormant for years and become active again when market conditions, liquidity, or laundering routes change.</p>
 <figure class="wp-block-table">
  <table class="has-fixed-layout">
   <thead>
    <tr>
     <th>Date</th>
     <th>Development</th>
    </tr>
   </thead>
   <tbody>
    <tr>
     <td>Nov. 5, 2022</td>
     <td>Pando Rings was exploited. Pando said it halted Pando Rings and other services and worked with SlowMist to trace the stolen funds. (<a href="https://pando.im/news/2022/2022-11-06-alert-to-pando-community-hack-of-pando-rings/" rel="noopener noreferrer nofollow">Pando Proto</a>)</td>
    </tr>
    <tr>
     <td>June 2026</td>
     <td>The linked exploiter wallet resurfaced, swapping $10M DAI for 6,243 ETH. (<a href="https://cryptobriefing.com/pando-rings-hacker-buys-eth-market-dip/" rel="noopener noreferrer nofollow">CryptoBriefing</a>)</td>
    </tr>
    <tr>
     <td>~June-Aug. 2026</td>
     <td>Wallet subsequently remained relatively dormant.</td>
    </tr>
    <tr>
     <td>Aug. 18, 2026</td>
     <td>Wallet swapped $3M DAI for ~1,570 ETH, then sent 800 ETH to Tornado Cash. (<a href="https://blockchain.news/flashnews/pando-rings-exploiter-moves-800-eth-tornado-cash" rel="noopener noreferrer nofollow">Blockchain News</a>)</td>
    </tr>
    <tr>
     <td>Aug. 15, 2026</td>
     <td>Pando announced its protocol sunset and service transition, which is potentially relevant context for the timing.</td>
    </tr>
   </tbody>
  </table>
 </figure><p><br>The transactions illustrate how stolen crypto can remain dormant for extended periods before being converted, consolidated, or moved through privacy infrastructure. That’s a pathway the defenders could well follow through.<br><br><br><br></p><p>Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.</p></strong>

Pando Rings oracle exploiter resurfaces, routes ETH into Tornado Cash

Table of Contents

Cryptopolitan_News

Other articles published on Aug 18, 2026

Join our free newsletter for daily crypto updates!