X100 Exploiter Sends 420.8 ETH to Tornado Cash

A wallet holding proceeds from X100’s Oct. 24 governance exploit deposited 420.8 $ETH into Tornado Cash on Oct. 26, according to Ethereum transaction records tallied by The Defiant.

The deposits nearly emptied the distributor wallet, but most of the roughly 2,023 $ETH previously traced through it and four recipient wallets remains outside the mixer. The four recipients still held about 1,602 $ETH combined in Etherscan snapshots around 9:48 a.m. ET.

Tornado Cash accepts deposits that can be withdrawn by a different address, using cryptographic proofs to conceal which deposit funds a withdrawal. Moving proceeds into those contracts adds a privacy mechanism to a fund trail that had previously consisted of transfers between identifiable Ethereum addresses.

The sender, `0x8296…42e5`, made 42 deposits of 10 $ETH and eight of 0.1 $ETH between 9:09:23 a.m. and 9:46:47 a.m. ET. The transactions used Tornado Cash’s router; the first deposit’s receipt records the onward transfer into its 10-$ETH pool.

The distributor received its original funding from `0x7ec2…fD63`, the address that received approximately 4.75 million USDT in the first exploit transaction. Blockaid said the attacker seized two of X100’s three Senate seats and used that majority to sell 400,000 X treasury tokens into an attacker-created pool.

Four Holding Wallets Remain Unspent

As The Defiant previously reported, the distributor sent 400 $ETH apiece to four wallets on Oct. 24 and retained roughly 423 $ETH.

On Oct. 26, it sent another 0.5 $ETH to each recipient before beginning the Tornado Cash deposits. Those recipients—`0xF637…35ea`, `0x6790…6391`, `0x64b1…81Ae` and `0x4fDB…Bef3`—each held approximately 400.5 $ETH.

The distributor was left with less than 0.001 $ETH. None of the four recipient addresses showed a sent transaction in the retained Etherscan snapshots.