POPA ReconHow it investigates

PeckShieldAlert flagged that the address labeled Aztec Exploiter deposited 1255.8 ETH (about $3M) into Tornado Cash on Oct 20, 2026 (post). CertiK gave the same 1255.8 ETH figure about an hour earlier (post). Salus says the 1255.8 ETH went in 30 transactions on Oct 19 in batches of 12x100 plus 5x10, 5x1 and 8x0.1 ETH (post). It ties the funds to the June 14 exploit of deprecated Aztec Connect contracts for about $2.19M, including 908.987 ETH plus DAI, wstETH and Yearn vault tokens (post). After holding about four months, the attacker redeemed the vault tokens and swapped holdings into another 346.767 ETH on Oct 19 before depositing, leaving all six stolen ERC-20 balances at zero (post). Satoshi Drops notes this was the old deprecated Aztec Connect contracts, not the current Aztec network (post). The exploiter address itself was not named in the posts found, so no on chain wallet link can be given here.

PeckShieldAlert flagged that the address labeled Aztec Exploiter deposited 1255.8 ETH (about $3M) into Tornado Cash on Oct 20, 2026 (post). CertiK gave the same 1255.8 ETH figure about an hour earlier (post). Salus says the 1255.8 ETH went in 30 transactions on Oct 19 in batches of 12x100 plus 5x10, 5x1 and 8x0.1 ETH (post). It ties the funds to the June 14 exploit of deprecated Aztec Connect contracts for about $2.19M, including 908.987 ETH plus DAI, wstETH and Yearn vault tokens (post). After holding about four months, the attacker redeemed the vault tokens and swapped holdings into another 346.767 ETH on Oct 19 before depositing, leaving all six stolen ERC-20 balances at zero (post). Satoshi Drops notes this was the old deprecated Aztec Connect contracts, not the current Aztec network (post). The exploiter address itself was not named in the posts found, so no on chain wallet link can be given here.

Ask your own