Aztec bridge exploiter moves 300 ETH to Tornado Cash

A wallet linked to the Aztec Private Rollup Bridge exploit deposited another 300 ETH into Tornado Cash, bringing its total transfers to the mixer to 500 ETH.

Summary

• The exploiter sent another 300 ETH, worth about $572,000, to Tornado Cash.
• Total deposits linked to the wallet have now reached 500 ETH, worth about $953,000 at the reported price.
• The Private Rollup Bridge lost approximately $2.165 million in a June exploit.
• Aztec said the affected legacy product was separate from its current network and AZTEC token.

Aztec exploiter deposits 300 ETH into Tornado Cash

Blockchain security firm PeckShield reported on Aug. 8 that an address labeled as the Aztec Private Rollup Bridge exploiter deposited 300 Ether into Tornado Cash.

The ETH was worth approximately $572,000 when PeckShield issued the alert. On-chain data included in the firm's report showed three separate deposits of 100 ETH each.

PeckShield said the latest transactions raised the wallet's cumulative Tornado Cash deposits to 500 ETH. Based on the valuation attached to its alert, the total was worth roughly $953,000 at press time.

Tornado Cash pools deposits and allows users to withdraw funds through different addresses. This process can obscure the direct connection between the original sending wallet and subsequent recipients, making asset tracking and recovery more difficult.

PeckShield did not identify the person or group controlling the address. There was also no immediate indication that any of the transferred funds had been recovered.

Private Rollup Bridge lost $2.165 million

The latest transfers relate to an exploit that affected Aztec's Private Rollup Bridge in June. Reports at the time placed the loss at approximately $2.165 million.

The stolen assets reportedly included 1,158 ETH, 150,000 DAI and 0.47 renBTC. Aztec said the affected bridge was a legacy product with no connection to the current Aztec network or its AZTEC token.

The Private Rollup Bridge incident followed a separate attack on Aztec Connect, another discontinued part of the project's earlier infrastructure.

As crypto.news previously reported, an attacker drained around $2.1 million from Aztec Connect's old RollupProcessor contract on June 14. The affected system had been discontinued about three years earlier and was no longer used by Aztec's active network.

Security researchers said that the exploit involved a mismatch between the transactions covered by a zero-knowledge proof and those processed during settlement. The weakness allowed the attacker to create unbacked balances and withdraw assets from the contract.

Aztec Labs could not pause or upgrade the deprecated contract because it had surrendered its administrative keys. The design made the contract immutable but also removed the team's ability to intervene after the flaw was exploited.

Tornado Cash transfers follow wider exploit surge

The two Aztec incidents formed part of a wider increase in crypto security breaches during June.

Crypto.news reported that DefiLlama recorded $74.9 million in losses across 29 exploits during the month. Its data included two separate Aztec incidents valued at approximately $2.1 million each.

Other exploiters have also used Tornado Cash to move stolen assets. In July, a wallet associated with the Drift Protocol exploit deposited 23,095 ETH, then worth around $44.4 million, into the mixer after months of inactivity.

A wallet linked to the Radiant Capital attack previously transferred 2,834 ETH into Tornado Cash, while the Cork Protocol exploiter routed approximately 4,520 ETH through the service.

The latest Aztec deposits therefore follow an established pattern in which attackers convert stolen assets into ETH before sending them through mixing protocols.

Tornado Cash remains under US scrutiny

The U.S. Treasury removed Tornado Cash and associated smart-contract addresses from its sanctions list in March 2025. The decision followed a federal appeals court ruling that the Treasury exceeded its authority by sanctioning immutable smart contracts.

However, U.S. authorities have continued to examine the use of crypto mixers in money laundering, sanctions evasion and cybercrime cases. Treasury officials have also maintained concerns about their use by North Korea-linked hacking groups.

The 500 ETH transferred by the Aztec exploiter represents less than half of the value reportedly taken from the Private Rollup Bridge. Further activity from the labeled address could show whether the remaining assets will also be routed through Tornado Cash or moved to other services.