Crypto Privacy Debate Intensifies as Hacker Hides $6.5M in Tornado Cash

The hacker behind a $9.6 million exploit on decentralized finance (DeFi) protocol ResupplyFi has deposited 1,607 ETH (approximately $6.5 million) into Tornado Cash, a privacy-focused cryptocurrency mixer, according to blockchain monitoring platforms PeckShield and PaidunPaidun monitoring^[1]. The funds originated from a June 2025 price manipulation attack on ResupplyFi’s wstUSR market, which exploited vulnerabilities in the protocol’s synthetic stablecoin integration. The attacker leveraged flash loans to artificially inflate the value of wstUSR, enabling the unauthorized withdrawal of $10 million in reUSD with minimal collateralResupplyFi exploit details^[2].

The movement of stolen assets into Tornado Cash highlights the ongoing challenges in tracing illicit crypto transactions. Tornado Cash, a decentralized protocol using zero-knowledge proofs to obscure transaction trails, allows users to deposit funds and withdraw them to a new address, severing the on-chain link between sender and receiverTornado Cash functionality^[3]. The platform, which faced U.S. sanctions in 2022 under Executive Order 13694 for allegedly facilitating money laundering, was delisted by the Treasury Department in March 2025 after a Fifth Circuit Court ruling deemed its immutable smart contracts non-sanctionable under the International Emergency Economic Powers ActTreasury sanctions delisting^[4]. This legal shift has reignited debates over the regulation of decentralized tools, with critics arguing that sanctions on code itself risk stifling innovation while proponents stress the need for accountability in combating illicit finance.

Security firms noted that the ResupplyFi exploit exploited weak oracle mechanisms, a recurring vulnerability in DeFi protocols. Cyvers, which analyzed the attack, stated the hacker manipulated internal token valuations to siphon funds, bypassing insolvency checksCyvers analysis^[5]. The stolen assets were initially swapped to ETH and distributed across two addresses before being funneled into Tornado Cash. PeckShield reported that the attacker’s main wallet still holds a portion of the proceeds, though the use of the mixer complicates further trackingPeckShield tracking report^[6].

ResupplyFi paused affected smart contracts and acknowledged the breach, stating that only its wstUSR market was compromised. The protocol has yet to release a full post-mortem but emphasized that other markets remain secureResupplyFi response^[7]. The incident adds to a growing tally of 2025 crypto hacks, with CertiK reporting over $2.1 billion in losses year-to-date, driven by tactics like social engineering and supply chain attacksCertiK 2025 hack report^[8]. Analysts warn that DeFi protocols reliant on synthetic assets and oracle-dependent mechanisms remain particularly vulnerable, urging stronger input validation and real-time anomaly monitoring to mitigate risksDeFi security recommendations^[9].

The ResupplyFi case underscores the tension between privacy and regulatory oversight in the crypto space. While Tornado Cash’s delisting has been hailed as a win for open-source developers, regulators continue to target individual actors exploiting decentralized platforms. The U.S. Department of Justice has separately indicted Tornado Cash co-founders Roman Storm and Roman Semenov for their alleged roles in laundering over $1 billion in stolen fundsDOJ indictment details^[10]. As the legal landscape evolves, the balance between financial privacy and compliance remains a contentious issue, with implications for the future of decentralized finance.