Hacker Launders $30M in Stolen ETH Through Tornado Cash, Netting $9.37M Profit

The hacker who stole $23 million from the crypto exchange Bitrue in April 2023 has resurfaced, laundering the stolen funds through Tornado Cash more than a year after the attack. Blockchain analysts have observed that the individual has now cycled over $30 million worth of Ethereum (ETH) through the sanctioned coin mixer, turning a profit in the process.

According to crypto analytics firm EmberCN, the attacker sold the stolen ETH shortly after the 2023 exploit, then re-entered the market when prices dropped to around $1,472 in April. With ETH now trading above $2,800, the hacker has been consolidating gains and using Tornado Cash to obscure the trail. In total, the price swing has helped net the attacker a profit of roughly $9.37 million.

On-chain data from Etherscan and Debank confirms that the entirety of the stolen ETH has been funneled through Tornado Cash, with large deposits recorded in recent weeks. The activity appears to have ramped up again on Thursday, pointing to a long-running laundering strategy. Some of the funds also made their way to HyperLiquid, a decentralized derivatives platform. Analysts suggest that the move could be for leveraged trading or simply to add another layer of obfuscation.

The April 2023 attack on Bitrue targeted a vulnerability in one of the exchange’s hot wallets. The hacker made off with ETH, SHIB, HOT, and other tokens before Bitrue halted withdrawals and launched an internal security review. The company promised to cover user losses and said it remained solvent, though the attacker’s identity has never been confirmed and no funds have been recovered.

Tornado Cash has been under U.S. sanctions since August 2022, when the Treasury Department accused it of facilitating large-scale money laundering, including activity tied to North Korea’s Lazarus Group. Despite that, the mixer’s smart contracts remain live on the Ethereum network and continue to be used. These types of protocols work by pooling funds from multiple users and redistributing them, making it extremely difficult to trace individual transactions—a fact that continues to draw both criminals and regulatory scrutiny.

The renewed laundering effort comes amid a broader spike in crypto-related crime. Security firm Immunefi reports that $1.67 billion was lost to in the first quarter of 2025, with decentralized finance (DeFi) protocols accounting for most of the damage. This incident highlights the ongoing challenges in the crypto industry, where sophisticated hackers continue to exploit vulnerabilities and launder funds through sanctioned platforms, despite regulatory efforts to curb such activities.