An Ethereum address labeled as belonging to the Aztec Connect exploiter moved approximately 1,255.8 ETH into Tornado Cash, worth about $3 million at the time, according to security researcher PeckShield and corroborating on-chain monitoring. The activity represents a movement of assets connected to a previous exploit, not a newly discovered attack against Aztec.
PeckShield’s alert was published on October 20, while detailed tracing from other monitors dates the batch of deposits to October 19. The distinction matters: the date of the warning is not necessarily the date when every transaction occurred. Nor does attribution of a blockchain address prove the identity of the individual controlling it.
The funds were reportedly deposited through 30 transactions after holdings associated with the June Aztec Connect exploit were consolidated into ether. The transfers may complicate downstream tracking but do not establish where any of the ETH went afterward, whether it was converted to cash or whether an exchange was involved.
How Much ETH Was Moved From the Exploiter-Labeled Address?
In an October 20 security alert, PeckShield said an address it labeled as associated with the Aztec exploiter deposited 1,255.8 ETH into Tornado Cash. At the cited valuation, the deposits represented roughly $3 million.
Additional monitoring described a set of 30 deposits: twelve transfers of 100 ETH, five of 10 ETH, five of 1 ETH and eight of 0.1 ETH. Those amounts sum to 1,255.8 ETH. The denominations are useful in reconstructing a deposit batch, but they do not reveal the owner of the recipient notes or link an eventual withdrawal to a particular deposit.
The transactions were reported as occurring on October 19, before PeckShield’s next-day notice. An earlier or later snapshot might capture additional transactions, so the 1,255.8 ETH figure should be treated as the amount documented in that batch rather than the final total of all activity involving the exploiter.
The public evidence is primarily a transaction-cluster attribution. There is no independently authenticated confession, named human controller or evidence of a fresh contract breach accompanying this alert.
What Was the Original Aztec Connect Exploit?
The suspected funds originate from a June 2026 attack against an old, deprecated Aztec Connect rollup contract on Ethereum. Researchers estimated the original theft at approximately $2.19 million in ETH and other tokens. This incident was separate from the current Aztec network and should not be described as evidence that its live systems have just been compromised.
In a technical reconstruction published in June, security company Blockaid described how a settlement-verification flaw in the retired rollup infrastructure permitted assets to be withdrawn without corresponding valid deposits. Its report distinguished the defect from theft of the operator’s keys or a general break in the underlying cryptographic proof system.
Initial holdings identified after the attack included approximately 908.987 ETH and assets denominated in DAI, wrapped staked ether and vault tokens. The October monitoring indicates that vault tokens and other stolen holdings were subsequently redeemed or converted, yielding an additional approximately 346.767 ETH before the funds were deposited in the privacy protocol.
That explains why an October report can describe roughly $3 million in ETH deposits even though the original June exploit was valued around $2.19 million. The asset mix changed, conversion amounts were expressed in ETH, and the dollar price of ether differed between observations. It is not evidence that the exploit itself happened again or that the original dollar losses should simply be replaced with the later valuation.
What Does a Tornado Cash Deposit Actually Establish?
Tornado Cash is a privacy system built around smart contracts that receive deposits and allow withdrawals using cryptographic proofs. An observer can see when deposits are made from a public address, but the design can make it difficult to connect them directly with later withdrawals.
The on-chain deposits therefore establish a direction of movement from the labeled source addresses into the protocol’s contracts, subject to confirmation of the transaction records. They do not establish a conventional exchange sale or identify the final recipient. A claim that the entire amount was laundered into fiat currency would require additional evidence.
Several denomination sizes in the reported Aztec batch are compatible with the fixed-deposit structures typically associated with the privacy service. Still, the public alert does not supply a complete downstream withdrawal map, so the amount of ETH ultimately moved beyond those contracts remains an open question.
Similar attribution limits apply to the Drift exploit-linked wallets that transferred 25,700 ETH to Tornado Cash on October 20. The incidents differ considerably in scale and background; their common feature is a visible move into privacy infrastructure after an earlier theft.
The possibility of innocent use of privacy software does not invalidate the concern generated by an exploiter-labeled source. Equally, it would be wrong to label every unrelated depositor as a criminal because they used the same smart-contract system.
Why Is the Older Aztec Infrastructure Distinction Important?
Aztec has undergone several generations of privacy-oriented infrastructure. The exploited Aztec Connect contract was an older, deprecated component, not proof that the latest network or its active applications shared the same vulnerability.
Historical vulnerabilities can nonetheless matter after a product has been retired. Smart contracts may remain deployed and hold assets, and their code may be immutable or difficult to alter. If withdrawal or verification logic is unsafe, funds can remain exposed even when the service is no longer marketed to new users.
That continuing attack surface is why users should distinguish discontinued applications, still-live contracts and current infrastructure when assessing risk. A name such as ‘Aztec exploiter’ in an analytics database can compress several different incidents and product generations into a misleading shorthand.
DaveFinances’ coverage of traced Ledger-related theft funds entering Tornado Cash similarly shows how recovery and attribution questions can persist long after the original attack. That was a separate event involving different suspected actors.
What Should Investigators and Token Holders Watch Next?
The next useful evidence would include the exact 30 transaction hashes, the source address history, conversion transactions and independent examination of how the wallet was connected to the June exploit. Those records would help establish the completeness of the reported total and the reliability of the original attribution.
For affected holders, tracking funds is not equivalent to getting them back. A recovered address label can guide an investigation, but moving money from an exploiter address into a privacy contract can sharply reduce visibility into any subsequent movements.
Past investigations into Bitget attack-linked transfers toward privacy infrastructure illustrate why an intermediate deposit cannot be treated as proof of the final destination. The distinction matters both to recovery efforts and to claims about where the attacker realized value.
The central October 20 development is PeckShield’s published identification of a 1,255.8 ETH Tornado Cash deposit cluster linked by investigators to the former Aztec Connect exploit. It remains an attributed post-hack fund movement, with no newly confirmed attack, verified human controller or publicly established withdrawal destination.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574