Latest Transfers Mark Calculated Pace

A blockchain address linked to the exploitation of Aztec’s discontinued Connect rollup and Private Rollup Bridge has deposited an additional 300 ETH into Tornado Cash. The transfer, valued at approximately $572,100 at the time, occurred on August 8 and raised the cumulative amount sent to the mixer to 500 ETH, or about 55 percent of the 909 ETH taken in the original incident.

Security firm PeckShield identified the activity, noting that the latest deposits consisted of three separate 100 ETH transactions. This followed a 145 ETH deposit on July 2 worth roughly $227,650. The gap of 37 days between the two batches points to a deliberate, spaced-out approach rather than an immediate bulk movement of the stolen assets.

The method stands in contrast to earlier high-volume cases. In the 2022 Beanstalk episode, attackers routed 24,930 ETH through the same mixer across 270 transactions executed in rapid succession. Here the perpetrator has moved funds in smaller, irregular tranches over more than a month while still retaining a substantial portion of the original haul.

Origins of the June Breach

The funds originated from an exploit on June 14 that drained roughly $2.19 million from outdated Aztec Connect rollup contracts. According to investigations by Blockaid, the stolen assets included 909 ETH along with 270,513 DAI, 168 wstETH and other tokens. A second transaction the following day extracted an additional approximately $88,000 in residual positions from the same legacy system using a nearly identical technique.

Researchers determined that the vulnerability lay in the proof verification and settlement logic of the deprecated contracts, not in Aztec’s underlying cryptography. The attacker was able to generate balances that lacked corresponding deposits. Because the contracts had already been retired and Aztec Labs no longer held administrative keys, the team could not pause or upgrade the immutable code. The active Aztec Network and its AZTEC token remained unaffected.

One report placed the Private Rollup Bridge loss near $2.165 million and listed a slightly different mix of assets, including 1,158 ETH, 150,000 DAI and a small amount of renBTC. Across accounts, the core finding is consistent: the incident targeted abandoned infrastructure that still held economic value.

Broader Pattern of Crypto Incidents

The Aztec case forms part of a larger trend recorded in the first half of 2026. TRM Labs data show 207 crypto hacks during that period, the highest half-year total on record, producing $972 million in losses. That figure is less than half the $2.3 billion recorded in the same stretch of 2025. Smart-contract exploits numbered 125, with a median loss near $219,000.

Tornado Cash continues to play a significant role in the movement of illicit proceeds. It accounted for about 20 percent of global mixer volume in 2026 and, according to academic research from the University of Birmingham and the University of Sydney, facilitated 78.33 percent of examined Ethereum-based hacking events. The service’s share declined after U.S. sanctions in 2022, yet it remains the dominant mixer on Ethereum networks.

Those sanctions were lifted on March 21, 2025, following a Fifth Circuit ruling that immutable smart contracts do not constitute property subject to OFAC jurisdiction. Authorities nevertheless maintain scrutiny of mixers in connection with money laundering, sanctions evasion and cybercrime, including activity linked to North Korean groups.

Tracking Challenges Persist

Although Tornado Cash is designed to sever the on-chain link between deposits and withdrawals, timing, wallet behavior and external activity can still supply investigative leads. Firms such as TRM Labs have employed behavioral correlation, anonymity-set analysis and off-ramp identification to follow funds through the protocol. No recovery of the Aztec-linked ETH has been reported, and the labeled address retains the remaining portion of the stolen ether.

The episode illustrates the lasting exposure created by legacy smart contracts that continue to hold assets long after a protocol has moved on. Once those assets leave the original contracts, the subsequent laundering steps frequently rely on established mixers even when the pace of transfers is intentionally slowed.