A sophisticated attacker who compromised a multi-signature wallet and stole $27.3 million has now laundered $19.4 million through privacy protocol Tornado Cash A sophisticated attacker who compromised a multi-signature wallet and stole $27.3 million has now laundered $19.4 million through privacy protocol Tornado Cash

Hacker Drains $27M From Multi-Sig Wallet, Launders $19M via Tornado Cash

2026/01/06 23:01
4 min read

A sophisticated attacker who compromised a multi-signature wallet and stole $27.3 million has now laundered $19.4 million through privacy protocol Tornado Cash while maintaining a leveraged trading position worth nearly $10 million.

The incident, first detected by blockchain security firm PeckShield, marks the latest in a series of major exploits targeting crypto holders in early 2026.

PeckShield reported that the drainer withdrew 1,000 ETH, worth $3.24 million, from the lending platform Aave before depositing it into Tornado Cash, joining 6,300 ETH already laundered through the mixing service.

The attacker, who controls the compromised multi-signature wallet, simultaneously holds a $9.75 million leveraged long position consisting of $20.5 million in ETH against $10.7 million in DAI.

Wave of Exploits Hits Crypto Platforms

The multi-sig wallet drain occurred alongside multiple other security incidents detected within the past 24 hours.

PeckShield identified address 0xB8b4…3714 actively laundering 2,479.1 ETH, worth $7.9 million, through Tornado Cash, with funds originating from multiple TRON wallets before being bridged to Ethereum.

The investigators linked the attack to a “pig-butchering” investment scam that typically lures victims through fake romantic relationships before stealing their crypto holdings.

Separately, the exploiter behind September’s UXLink hack swapped 248 wrapped Bitcoin for 23 million DAI within an hour, moving stolen assets from an attack that minted billions of unauthorized tokens.

Blockchain security firm CertiK simultaneously flagged another $1.4 million exploit on an unverified contract related to TMXTribe on Arbitrum.

The attackers repeatedly minted and staked TMX LP with USDT, swapped for USDG, then unstaked and sold more USDG to drain USDT alongside wrapped SOL and WETH through a looping mechanism executed multiple times.

These exploits follow closely after hardware wallet manufacturer Ledger disclosed that customer data, including names, postal addresses, emails, and phone numbers, was accessed through a breach at payment processor Global-e on January 5.

While Ledger confirmed no payment card details, passwords, or private keys were exposed, security researchers warned that the leak significantly increases phishing and social engineering risks.

Particularly, given Ledger’s history of data breaches, dating back to a devastating 2020 incident that exposed 1.1 million email addresses and detailed personal information for approximately 292,000 customers, whose data was later dumped publicly.

Physical Security Risks Escalate for Crypto Holders

The Ledger breach has intensified concerns about physical attacks targeting cryptocurrency holders, particularly as violent incidents against users reach unprecedented levels.

Blockchain researcher Ignas, who confirmed receiving notification of his leaked data, warned that “wrench physical attacks are getting more common and I believe if economy & world gets more unstable, these attacks will become serious issue for crypto users.

Security researcher NanoBaiter also cautioned that “threat actors are probably using this data for social engineering attacks and phishing emails,” while another analyst warned that cross-referencing the 2020 and 2025 Ledger datasets with AI tools allows attackers to identify high-value targets with a very good precision.

Investor Haseeb Qureshi’s analysis of physical violence data showed attacks against crypto users have increased over time and grown more violent.

However, he noted that “some of this is just population effects because there are more people who hold crypto now.

Rezo, a Ledger user himself, emphasized the centralization risk inherent in crypto infrastructure, stating that “as long as crypto products depend on centralized infrastructure (payment processors, shipping, email), we’re exposed.

He added that while “Ledger didn’t get hacked, their payment processor did,” the leaked name and contact information create “perfect phishing material.”

December 2025 saw crypto hack losses drop 60% month-over-month to $76 million according to PeckShield, down from November’s $194.2 million.

Despite the decline, major incidents continue occurring, including a $50 million address poisoning scam, a $27.3 million private key leak, and Trust Wallet’s Christmas Day exploit that drained $7 million through a compromised browser extension.

As it stands now, security experts have advised victims whose information was exposed to be very cautious of phishing emails and spam, possibly change their location for safety, and use temporary details and addresses for deliveries, etc.

Market Opportunity
Ambire Wallet Logo
Ambire Wallet Price(WALLET)
$0.00788
$0.00788$0.00788
+0.38%
USD
Ambire Wallet (WALLET) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact crypto.news@mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Family member warns Trump’s cognitive decline 'only going to worsen' as US braces for war

Family member warns Trump’s cognitive decline 'only going to worsen' as US braces for war

Trump’s niece Mary Trump confessed on CNN that her uncle’s mental impairment is more obvious than ever, and the aging president does not need to be leading the
Share
Alternet2026/02/27 10:46
Aave DAO to Shut Down 50% of L2s While Doubling Down on GHO

Aave DAO to Shut Down 50% of L2s While Doubling Down on GHO

The post Aave DAO to Shut Down 50% of L2s While Doubling Down on GHO appeared on BitcoinEthereumNews.com. Aave DAO is gearing up for a significant overhaul by shutting down over 50% of underperforming L2 instances. It is also restructuring its governance framework and deploying over $100 million to boost GHO. This could be a pivotal moment that propels Aave back to the forefront of on-chain lending or sparks unprecedented controversy within the DeFi community. Sponsored Sponsored ACI Proposes Shutting Down 50% of L2s The “State of the Union” report by the Aave Chan Initiative (ACI) paints a candid picture. After a turbulent period in the DeFi market and internal challenges, Aave (AAVE) now leads in key metrics: TVL, revenue, market share, and borrowing volume. Aave’s annual revenue of $130 million surpasses the combined cash reserves of its competitors. Tokenomics improvements and the AAVE token buyback program have also contributed to the ecosystem’s growth. Aave global metrics. Source: Aave However, the ACI’s report also highlights several pain points. First, regarding the Layer-2 (L2) strategy. While Aave’s L2 strategy was once a key driver of success, it is no longer fit for purpose. Over half of Aave’s instances on L2s and alt-L1s are not economically viable. Based on year-to-date data, over 86.6% of Aave’s revenue comes from the mainnet, indicating that everything else is a side quest. On this basis, ACI proposes closing underperforming networks. The DAO should invest in key networks with significant differentiators. Second, ACI is pushing for a complete overhaul of the “friendly fork” framework, as most have been unimpressive regarding TVL and revenue. In some cases, attackers have exploited them to Aave’s detriment, as seen with Spark. Sponsored Sponsored “The friendly fork model had a good intention but bad execution where the DAO was too friendly towards these forks, allowing the DAO only little upside,” the report states. Third, the instance model, once a smart…
Share
BitcoinEthereumNews2025/09/18 02:28
Digital Dentistry Market Growing at 9.62% CAGR to 2031 as Restorative Dentistry Held 34.54% Share in 2025, Says a 2026 Mordor Intelligence Report

Digital Dentistry Market Growing at 9.62% CAGR to 2031 as Restorative Dentistry Held 34.54% Share in 2025, Says a 2026 Mordor Intelligence Report

HYDERABAD, India, Feb. 26, 2026 /PRNewswire/ — According to the latest Mordor Intelligence report, the digital dentistry market size is anticipated to grow from
Share
AI Journal2026/02/27 10:15