A wallet tied to the 2022 Pando Rings exploit has pushed 4,000 Ethereum (ETH) — approximately $9.22 million — through the cryptocurrency mixer Tornado Cash, close to four years after the decentralized finance (DeFi) project was drained of millions.

Blockchain monitoring data published on November 2, 2026, surfaced the movement shortly after the same address completed a sizable Ethereum purchase. The transfer has revived concerns that stolen cryptocurrency is flowing into privacy-focused services, which could complicate attempts to trace and recover the funds.

Millions Converted Into Ethereum Ahead of Mixer Deposit

On-chain monitoring linked the address to a recent acquisition of 7,548 ETH for roughly 16.98 million DAI, at an average price of about $2,249 per ETH. The buy came on the heels of a broader downturn in cryptocurrency markets. Shortly after, 4,000 ETH — about 53% of the reported purchase — was sent into Tornado Cash, as reported by KuCoin News.

The monitoring also documented earlier maneuvers involving the decentralized lending platform Aave. On October 30, the address is reported to have deposited 16.8 million USDT, borrowed 5,000 ETH, repaid the loan, and withdrawn its collateral — a borrow-and-repay sequence that temporarily places borrowed assets under a wallet's control without an outright purchase. Taken together, the transactions point to an operator actively managing substantial holdings before moving funds through the privacy protocol.

Mixer Use Adds Hurdles for Investigators

Tornado Cash pools user deposits and processes withdrawals through privacy-focused smart contracts, breaking the visible connection between the two. Ethereum transfers themselves stay on public record, but tying a specific deposit to a later withdrawal becomes considerably harder — a dynamic that could create additional obstacles for investigators attempting to follow the Pando Rings proceeds.

The underlying attack dates to November 5, 2022, when attackers exploited a price oracle vulnerability, with losses estimated at approximately $20 million to $22 million — meaning the funds resurfaced just days before the fourth anniversary of the breach. The latest movement demonstrates how stolen cryptocurrency can remain in circulation years after an exploit. Even so, sending funds through Tornado Cash does not establish that the attacker has successfully converted the assets into untraceable funds.

Selling Pressure Not Yet Confirmed

The wallet's reported 7,548 ETH purchase outpaced the 4,000 ETH sent to the mixer by 3,548 ETH. That gap, however, does not independently confirm the address's remaining balance. Available monitoring reports have likewise not established that the transferred Ethereum reached a centralized exchange or was sold. Any subsequent movement of the address's remaining ETH would itself be visible on the public blockchain, though funds routed through Tornado Cash would again be considerably harder to attribute.

For cryptocurrency investors, the distinction matters because large on-chain transfers do not automatically create immediate selling pressure.

The incident underscores persistent security challenges across decentralized finance. While blockchain transparency helps investigators identify suspicious wallet activity, privacy tools can make subsequent fund movements considerably harder to reconstruct.