InvestNot yet confirmed elsewhere1 publisher2 min readPublished Updated
Triple-A's treasury attacker sends $12.4M of ether into Tornado Cash in 56 deposits
Triple-A's July treasury attacker deposited 4,970 ETH, about $12.4 million, into Tornado Cash on Oct. 9, blockchain security firm Salus said. Getting the coins back now depends on tracers tying withdrawals from the mixer to the attacker, as Salus did once with earlier withdrawals.
The Investor · Invest desk
Two bars compare ETH deposited into Tornado Cash by the Triple-A attacker: 49 deposits of 100 ETH held 4,900 ETH, while seven deposits of 10 ETH held 70 ETH, according to Salus.
ETH deposited into Tornado Cash by the attacker, by deposit size (Salus)
| Item | Value | Claim |
|---|---|---|
| 49 deposits of 100 ETH | 4,900 ETH | 3 |
| Seven deposits of 10 ETH | 70 ETH | 3 |
What happened
- Salus counted 49 deposits of 100 ETH and seven of 10 ETH, putting 4,900 ETH in the large lots and 70 ETH in the small ones.
- Before depositing, the attacker merged two streams of funds that had passed through separate intermediary addresses into a single wallet, Salus said.
- Triple-A said the compromised wallets were held by its Singapore entity, Triple A Technologies Pte. Ltd., and that no other company entities were affected.
- In an Aug. 21 post-mortem, Triple-A said the attack began with social engineering of an engineering employee, using impersonation, several channels and a live call.
Why it matters
- cost Triple-A said by July 27 that its treasury reserves would absorb the hit, so the roughly $11.8 million falls on the company's own capital and any coins recovered from the mixer would go back there.
- exposure One engineer's compromised credentials were enough to reach API credentials that could execute cryptocurrency withdrawals, so any firm wiring treasury withdrawals to API credentials faces the same route in.
- precedent Because client money sat in trust accounts and Triple-A held no client crypto, the breach stayed inside its own treasury, giving customers of other payment firms a concrete custody question to ask.
Seventy-six days passed between the drain Triple-A detected on July 25 and the Oct. 9 deposits Salus logged [9] [2] [18]. The attacker had split the funds between two intermediary wallets on Sep. 6, after bridging the stolen assets to Ethereum and swapping them [5]. That was 33 days before the deposits [19]. Lots of 100 ETH carried 98.6% of what went into the mixer [20].
The public figures do not reconcile cleanly. On July 25 researchers put the receiving address at about 5,226.66 ETH, worth about $9.7 million at the time [8]. The October deposits held 256.66 ETH fewer [21]. Per coin, the July valuation works out to about $1,856 and the October one to about $2,495 [22] [23], so the ether gained about a third in dollar terms while it waited [24]. On those numbers the attacker mixed $0.6 million more than the roughly $11.8 million loss estimate that crypto.news attributed to investigator Specter [7] [25], and did it with fewer coins. In its post, Salus wrote: "One stream included funds from earlier withdrawals." [6] Those were withdrawals from Tornado Cash itself, so some of the 4,970 ETH had already been through the mixer once [17].
In our view the deposits matter more to the people chasing the coins than to Triple-A's solvency. The company said: "Triple-A remains well capitalised, is able to meet all its liabilities." [11] The money it lost was its own treasury's [1]. The Oct. 9 deposits bear on the recovery effort Triple-A runs with blockchain forensic specialists, outside cybersecurity experts and Singapore police [14].
Coins that leave the pool and land where a platform or a court can freeze them would give the Singapore case something to seize. A second path is that tracers tie the withdrawals to the attacker, as Salus did with the earlier ones [17], and the coins still never stop anywhere seizable. The third is that no link is made. Salus's own record argues against treating the mixer as the end of the trail, since one pass through Tornado did not stop it from connecting those funds to this attacker [17]. We'd still expect most of the 4,970 ETH to end up in the second or third case. A traced coin comes back only when someone holding it can be made to return it. The crypto.news account reports no recovered funds. Frozen or returned ether announced by Triple-A or Singapore police would prove that view wrong.
What to watch
- Salus's monitoring of 100-ETH and 10-ETH withdrawals from Tornado Cash after Oct. 9, and whether any are tied to the Triple-A attacker.
- Any accounting from Triple-A or Salus of how many of the deposited ether had already passed through the mixer once.
- Filed accounts for Triple A Technologies Pte. Ltd. showing how much of the treasury reserves the July loss consumed.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence52
- Adoption48
- Hype gap0
- Incentives58
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The attacker behind Triple-A's July treasury breach transferred 4,970 ETH worth approximately $12.4 million into Tornado Cash, according to blockchain security firm Salus.
- [2]
4,970 ETH entered Tornado Cash on Oct. 9 through 56 deposits, according to Salus.
- [3]
Salus tracked 49 deposits of 100 ETH and seven deposits of 10 ETH linked to the Triple-A attacker; the larger deposits held 4,900 ETH and the smaller ones 70 ETH.
- [4]
The attacker combined funds from two intermediary addresses through a single wallet before depositing them into Tornado Cash, according to Salus.
- [5]
According to Salus, after moving assets across blockchains to Ethereum and exchanging the tokens, the attacker divided the funds between two addresses on Sep. 6.
- [6]
One stream included funds from earlier withdrawals.
- [7]
Public estimates placed Triple-A's July treasury loss at approximately $11.8 million; crypto.news attributed the estimate to blockchain investigator Specter.
- [8]
On July 25, researchers put the receiving address's balance at approximately 5,226.66 ETH, worth about $9.7 million at the time.
- [9]
Triple-A said it detected unauthorized access on July 25 and temporarily placed certain services into maintenance mode for approximately three hours.
- [10]
By July 27, Triple-A had confirmed unauthorized wallet access and said the financial impact would be absorbed through its treasury reserves.
- [11]
Triple-A remains well capitalised, is able to meet all its liabilities.
- [12]
Triple-A said the compromised wallets belonged to Triple A Technologies Pte. Ltd., its Singapore entity, and that no other company entities or operations were affected.
- [13]
Triple-A said customer funds were held separately in trust accounts with safeguarding institutions and were not exposed because it did not provide digital asset custody on behalf of clients.
- [14]
Triple-A identified internal and external cybersecurity experts, blockchain forensic specialists and Singapore police as participants in its investigation and asset-recovery efforts.
- [15]
In an Aug. 21 post-mortem, Triple-A said the attack began with social engineering against an engineering employee, involving impersonation, communications across different channels and a live call.
- [16]
After compromising credentials, the attacker obtained elevated system permissions, deployed malware, accessed production databases and abused API credentials to execute cryptocurrency withdrawals, according to Triple-A's post-mortem.
- [17]
Salus said one of the two fund streams that reached the depositing wallet contained funds from earlier withdrawals from the mixer, and linked the activity to the Triple-A attacker.
- [18]
76 days elapsed between Triple-A detecting the breach on July 25 and the Oct. 9 Tornado Cash deposits.
- [19]
The Sep. 6 split came 33 days before the Oct. 9 deposits.
- [20]
The 100-ETH deposits carried about 98.6% of the 4,970 ETH deposited.
- [21]
The deposits held 256.66 ETH fewer than the July 25 receiving-address balance.
- [22]
The July 25 valuation implies about $1,856 per ETH.
- [23]
The Oct. 9 valuation implies about $2,495 per ETH.
- [24]
The implied per-coin value rose about 34%, roughly a third, between the two valuations.
- [25]
The $12.4 million deposited exceeds the roughly $11.8 million public loss estimate by about $0.6 million.
Sources
1 independent publisher whose own reporting we read for this story.
- crypto.newsTriple-A attacker moves $12.4m in ETH to Tornado Cash
1 article · October 10, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Blockchain forensicsFollow
- Social Engineering AttacksFollow
- Crypto treasury securityFollow
- Cryptocurrency mixersFollow
Entities
- Triple-AFollow
- SalusFollow
- Tornado CashFollow
- SpecterFollow
- PeckShieldFollow
- SygniaFollow
- ZeroshadowFollow
- EthereumFollow
- Monetary Authority of SingaporeFollow
- Roman StormFollow