WazirX Funds on the Move as Hacker Shifts $33 Million to Tornado Cash

Around $33 million in crypto stolen from Indian crypto exchange WazirX are on the move, with the hacker responsible sending the funds to a new address and then to coin mixer Tornado Cash.

The hacker has been moving funds in blocks of 5,000 ETH (around $12 million at today’s Ethereum price), shifting one tranche Thursday morning according to security firm Cyvers. It follows earlier transfers on Wednesday and Monday, bringing the total transferred over the course of the week to $33 million.

Per data from on-chain analytics firm Arkham, the funds were subsequently sent to Tornado Cash. The hacker currently holds around $51 million in tokens, the bulk of which is in ETH.

The hack of India’s largest crypto exchange in July saw $235 million in funds moved after WazirX experienced a “security breach” in one of its multisig wallets.

Since the hack, which has been linked to North Korea-based actors, WazirX has pursued a restructuring proposal in a bid to make users whole. A blame game has ensued following the hack, which has seen crypto custody service Liminal and crypto exchange Binance trade barbs with the exchange.

In a statement earlier this week, Binance claimed that the WazirX team and founder Nischal Shetty “continue to mislead WazirX customers” as to the relationship between the exchanges. “Binance has not owned, controlled, or operated WazirX at any time, including before, during, or after the July 2024 attack,” the exchange wrote, adding that it has “no responsibility” for the operation of WazirX and that had no involvement with the compromised multisig wallet at the time of the attack.

In July, custody service Liminal hit back at claims that the attack involved its infrastructure, placing the firm at odds with WazirX’s own internal investigation into the hack.

What is Tornado Cash?

Tornado Cash is an Ethereum coin mixer, which uses tools including zero-knowledge (ZK) proof cryptography in order to anonymize user deposits and withdrawals.

The platform was sanctioned by the U.S. Treasury Department, which cited its use by criminals and state-sponsored hacking groups in laundering funds. In August 2023, Tornado Cash co-founder Roman Storm was arrested on charges of facilitating money laundering and sanctions violations; his trial was delayed in July 2024 after his defense cited “complex and novel legal and factual issues,” in the case, along with “millions of pages of documents,” produced during discovery.

Storm’s fellow Tornado Cash developer Alexey Pertsev was found guilty of money laundering by a Dutch court in May 2024, and sentenced to 64 months in prison.

The case has raised the ire of many in the crypto community, who have argued that developers and governance token holders should not be held liable for mixers that have been used to transfer illicit funds. In April, Coinbase chief legal officer Paul Grewal accused the U.S. Treasury of “bending old laws past their breaking point” in treating “immutable, open-source software code” as property, arguing that it “must seek authority from Congress” to do so.

Edited by Stacy Elliott.