Pando Rings exploiter sends 800 ETH to Tornado Cash

The wallet behind the 2022 Pando Rings hack swapped 3 million DAI for about 1,570 ETH on Aug. 18, then sent 800 ETH worth $1.52 million to Tornado Cash across eight transactions.

Onchain Lens, a blockchain tracker, flagged the reactivation on X after the address sat dormant for two months. "The hacker exchanged 3 million DAI for about 1,570 ETH, worth approximately three million dollars, through CoW Protocol," the tracker said.

The swap marks the second time this year the address has moved funds. Lookonchain reported on June 6 that the same wallet converted 10 million DAI into 6,243 ETH at an average price of $1,602, a trade the tracker described as "even the hacker is buying the $ETH dip."

The activity comes three days after Pando announced on Aug. 15 that it was sunsetting its protocol and moving its DeFi products into maintenance mode under Mixin. The funds remain traceable to the original exploit despite passing through the mixer.

An oracle that misread its own collateral

On Nov. 5, 2022, the attacker manipulated the price of the sBTC-WBTC liquidity provider token on 4swap, Pando's automated market maker, and used the distorted feed to attempt a $70 million withdrawal from Pando Rings. By the time the team responded, about $21.9 million in ETH, EOS, and BTC had left two Mixin wallets controlled by the hacker.

Pando worked with Mixin Network and cybersecurity firm SlowMist to freeze the remainder, including 2,022,662 EOS worth about $2.36 million and other tokens valued above $50 million. The company halted Pando Rings, 4swap, Pando Leaf, and Pando Lake until the oracle was fixed and promised to reimburse customers.

Why mixed funds stay visible

Sending funds through Tornado Cash does not erase the trail. TRM Labs tracked a June case in which someone withdrew about 664 ETH from the mixer and used it to take control of TOP, a small Ethereum protocol. The case shows mixer activity still signals risk even when the direct transaction path is hard to follow.

Tornado Cash's legal status has shifted. The US Treasury sanctioned the mixer in August 2022, then removed it from the sanctions list on March 21, 2025, after a federal appeals court ruled its immutable smart contracts were not "property" subject to designation. Large transfers through the protocol still draw attention rather than disappearing.

The timing of the wallet's activity is notable. Pando announced its protocol sunset on Aug. 15, three days before the exploiter moved funds. The episode illustrates the long tail of DeFi exploits, where stolen assets can sit dormant for years and resurface when market conditions or laundering routes change.

Oracle manipulation of the kind that hit Pando has become rare. Immunefi's six-year loss analysis found ecosystem-type attacks such as flash-loan oracle manipulation fell from about 19 percent of DeFi loss incidents in 2022 to less than 1 percent in 2025. The Pando exploiter is a remnant of an older era in DeFi security, still drawing on a weakness the industry has largely engineered around.

This article is for informational purposes only and does not constitute investment advice.