CertiK Traces Tornado Cash Activity to $282M Crypto Compromise

CertiK reported that at least 686 BTC was bridged to Ethereum, converted into about 19,600 ETH, split across multiple wallets, and then sent into the mixer. The theft was traced to a social engineering attack in which the attacker obtained a seed phrase, which allowed them to take control of a wallet holding approximately 1,459 BTC and more than 2 million Litecoin. Meanwhile, South Korean authorities said they dismantled a money laundering network that allegedly moved 148.9 billion won, or about $101.7 million, using cryptocurrency and domestic bank accounts. The Korea Customs Service stated that the operation ran from 2021 to 2025 and concealed illicit transfers as legitimate personal expenses.

Tornado Cash Used in $282M Wallet Hack

Roughly $63 million in cryptocurrency deposits routed through Tornado Cash have been linked to a massive $282 million wallet compromise that happened on Jan. 10. According to blockchain security firm CertiK, its monitoring systems identified interactions with the privacy mixer that were directly connected to the exploit.

CertiK’s analysis shows that a big portion of the stolen Bitcoin was first bridged to Ethereum using cross-chain swaps. At least 686 BTC was converted in this way, ultimately resulting in approximately 19,600 ETH arriving in a single Ethereum address. From there, the ETH was split across multiple wallets, with several hundred ETH sent onward from each address before finally entering Tornado Cash. While the $63 million figure is only a fraction of the total amount stolen, the pattern proves that there was a deliberate attempt to break the transaction trail after the exploit.

The laundering behavior seen in this case follows what industry experts describe as a well-established playbook. Marwan Hachem, CEO of blockchain security firm FearsOff, said the flow closely mirrors classic large-scale laundering strategies seen in cross-chain thefts involving Bitcoin and Litecoin. 

He pointed to the use of THORswap for Bitcoin-to-Ether conversions and the subsequent division of funds into roughly 400 ETH chunks as “textbook” tactics that are designed to reduce attention and complicate recovery efforts. Once funds enter a mixer like Tornado Cash, chances of recovery typically drop to near zero.

The Jan. 10 theft itself was traced to a social engineering attack rather than a protocol-level exploit. Blockchain investigator ZachXBT previously reported that the attacker impersonated wallet support staff, and tricked the victim into revealing a seed phrase. This allowed the crooks to gain full control of the wallet. The compromised address reportedly held around 1,459 BTC and more than 2 million Litecoin at the time of the attack.

While a small portion of the stolen funds—around $700,000—was flagged and frozen early in the laundering process, the vast majority of the assets were quickly moved beyond practical reach. 

South Korea Busts $102M Crypto Laundering Ring

In South Korea, authorities are fighting hard against crypt-related crime. South Korean customs authorities recently dismantled an international money laundering operation that allegedly moved close to 149 billion won, or about $101.7 million, through cryptocurrency transactions and the domestic banking system. 

The Korea Customs Service said that three individuals have been referred to prosecutors for suspected violations of the Foreign Exchange Transactions Act, according to a report by Yonhap News Agency.

Investigators allege the network operated for almost four years, from September of 2021 through June of 2025, and disguised illicit cross-border fund movements as legitimate personal expenses like cosmetic surgery fees and overseas tuition payments. To avoid detection, the suspects are accused of purchasing crypto assets across multiple jurisdictions, transferring them into South Korean wallets, converting them into local currency, and then distributing the proceeds through numerous domestic bank accounts. Authorities say this structure allowed the group to obscure the origin and destination of funds while exploiting both crypto rails and traditional banking channels.

The case reared its head during a broader crackdown on illegal foreign exchange activity in South Korea. Earlier this month, the Korea Customs Service announced year-round intensive inspections targeting underground money exchange operations, and warned that such activity could threaten exchange rate stability. 

Officials have pointed out growing discrepancies between trade proceeds processed by banks and the value of goods reported to customs, with the gap reaching roughly $290 billion in 2025, the largest in five years. Separate inspections conducted last year found that 97% of companies in a targeted industry were involved in illicit foreign exchange transactions, totaling about 2.2 trillion won.

The enforcement action also sheds some light on the increasing prominence of South Korea’s crypto market. Data from the Financial Services Commission shows that the country’s crypto asset market capitalization reached 95 trillion won, or about $64.6 billion, in June of 2025, with average daily trading volumes exceeding $4.3 billion.