A 2022 oracle hack starts moving again, three days after Pando shut its books

A wallet tied to the November 2022 Pando Rings oracle exploit came back to life on August 18 after two months of inactivity, swapping 3 million DAI for roughly 1,570 ETH through CoW Protocol, according to blockchain tracker Onchain Lens ^[1][2]. Roughly 800 ETH, worth about $1.52 million, then went into Tornado Cash across eight transactions ^[3]. That matters mostly for its timing: three days earlier, on August 15, Pando announced it was discontinuing the protocol and moving its DeFi products into maintenance mode under Mixin's supervision, with Pando Rings now serving only loan repayment and collateral withdrawal ^[4].

The mechanics of the original loss are worth restating because they are the kind of thing that gets filed away as solved. On November 5, 2022, an attacker manipulated the price of the sBTC-WBTC liquidity provider token on 4swap, Pando's automated market maker, and used that mispricing in an attempt to drain $70 million ^[5]. About $21.9 million in ETH, EOS and BTC left two Mixin wallets the attacker controlled before the team intervened ^[6], which is roughly 31 percent of the attempted haul ^[7]. Pando then worked with Mixin Network and SlowMist to lock the remainder, including 2,022,662 EOS worth about $2.36 million and other tokens valued at more than $50 million ^[8]. Pando Rings, 4swap, Pando Leaf and Pando Lake were suspended pending an oracle fix, with a commitment to reimburse users ^[9]. The publisher notes that oracle manipulation of this kind has become far less frequent as protocol development improved ^[10].

The wallet has not been idle in the interim, and it has not been behaving like a panicked launderer. Lookonchain reported on June 6 that the same address spent 10 million DAI on 6,243 ETH at an average price of $1,602 ^[11]. Add the August swap and that is 13 million DAI converted into ether across two visible tranches ^[12]. The August trade implies a price near $1,911 per ETH ^[13], which would put the June stack roughly $1.9 million above cost ^[14]. The change in behaviour is the destination, not the trading.

Mixing is not disappearance. TRM Labs tracked a June incident in which about 664 ETH withdrawn from Tornado Cash was used to take control of a small Ethereum project called TOP ^[15], which is the point: mixer flows still function as a risk signal even when the direct trail breaks. Tornado Cash's own legal position has moved as well. It was sanctioned by the US Treasury in August 2022 and removed from the sanctions list on March 21, 2025, after a federal appeals court held that immutable smart contracts are not "property" subject to sanctions law ^[16].

Two things to watch. First, the roughly 770 ETH from the August swap that has not yet reached the mixer ^[17], which will show whether this is a full exit or another partial rotation. Second, Pando's reimbursement pledge ^[9] against a protocol now in maintenance mode ^[4] and more than $50 million in frozen assets ^[8]: winding down the front end does not close the recovery question, and the counterparty on the other side of it is still trading.