POPA ReconCertiKAlert reported on Oct 20 2026 that the June Aztec rollup exploiter deposited 1255.8 ETH (about $3M) to Tornado Cash (post). That matches the June 14 Aztec Connect exploiter 0x0F18...dD17, labeled Aztec Connect Hacker, not the separate June 17/18 1158 ETH escapeHatch drain by 0x6952...E97F in tx. The June 14 incident drained about $2.19M (909 ETH plus DAI, wstETH, yvDAI, yvWETH, LUSD and yvLUSD) per Defi_Nerd_sec and was confirmed as a deprecated Aztec Connect exploit by Aztec Foundation. On chain, that hacker shows 30 outbound transfers to the Tornado Cash Router totaling about $3.03M, plus $2.18M inbound from Aztec Connect, consistent with the claimed 30 deposits of 1255.8 ETH noted here. An Aug 8 post had earlier tracked the same wallet at 500 ETH mixed (post). No hash list or Tornado deposit txs were published in the CertiK alert itself, only the dashboard.
CertiKAlert reported on Oct 20 2026 that the June Aztec rollup exploiter deposited 1255.8 ETH (about $3M) to Tornado Cash (post). That matches the June 14 Aztec Connect exploiter 0x0F18...dD17, labeled Aztec Connect Hacker, not the separate June 17/18 1158 ETH escapeHatch drain by 0x6952...E97F in tx. The June 14 incident drained about $2.19M (909 ETH plus DAI, wstETH, yvDAI, yvWETH, LUSD and yvLUSD) per Defi_Nerd_sec and was confirmed as a deprecated Aztec Connect exploit by Aztec Foundation. On chain, that hacker shows 30 outbound transfers to the Tornado Cash Router totaling about $3.03M, plus $2.18M inbound from Aztec Connect, consistent with the claimed 30 deposits of 1255.8 ETH noted here. An Aug 8 post had earlier tracked the same wallet at 500 ETH mixed (post). No hash list or Tornado deposit txs were published in the CertiK alert itself, only the dashboard.
$AZTECtornado