TrustedVolumes Hacker Moves $278K in Stolen Funds Through Mixers and Cross-Chain Swaps

Blockchain security firm PeckShield has reported that the hacker responsible for the recent TrustedVolumes exploit has successfully laundered approximately $278,000 worth of stolen cryptocurrency. The funds, part of a larger $6.7 million theft, have been moved through multiple privacy-focused protocols and cross-chain bridges.

How the Funds Were Moved

According to PeckShield’s on-chain analysis, the hacker executed two primary transactions. First, 10.2 ETH, valued at around $23,600, was deposited into Tornado Cash, a well-known cryptocurrency mixing service frequently used to obfuscate the trail of stolen assets. Second, a larger sum of 110 ETH, approximately $250,000, was swapped for Bitcoin through THORChain, a decentralized cross-chain liquidity protocol. This method allows the hacker to convert Ethereum into Bitcoin without relying on centralized exchanges, making it significantly harder for law enforcement to freeze or trace the funds.

Background on the TrustedVolumes Exploit

TrustedVolumes, a decentralized finance (DeFi) protocol, suffered a major security breach earlier this year, resulting in the loss of $6.7 million. The exploit targeted vulnerabilities in the platform’s smart contract code, allowing the attacker to drain funds from liquidity pools. The incident was part of a broader trend of DeFi hacks that have collectively cost the industry hundreds of millions of dollars in 2024 and 2025.

Why This Matters for the Crypto Ecosystem

The continued use of mixing services like Tornado Cash and cross-chain bridges like THORChain highlights a persistent challenge for regulators and blockchain forensic teams. While Tornado Cash has been sanctioned by the U.S. Treasury Department, its decentralized nature means it remains operational and accessible. Similarly, THORChain’s non-custodial, cross-chain architecture allows users to swap assets without KYC checks, making it an attractive tool for bad actors seeking to launder funds. This case underscores the ongoing cat-and-mouse game between security researchers and hackers, as well as the need for more robust on-chain surveillance and regulatory frameworks.

Conclusion

The laundering of $278,000 from the TrustedVolumes hack is a clear example of how sophisticated attackers use decentralized tools to evade detection. While the total sum moved so far represents only a fraction of the overall theft, it signals the hacker’s intent to gradually liquidate the stolen assets. The crypto community and law enforcement agencies will be watching closely for further movements, as any slip in operational security could lead to the identification of the perpetrator.

FAQs

Q1: What is Tornado Cash and why do hackers use it?
Tornado Cash is a decentralized privacy protocol that mixes cryptocurrencies from multiple users, making it difficult to trace the origin of funds. Hackers use it to break the on-chain link between stolen assets and their wallets.

Q2: How does THORChain help in laundering crypto?
THORChain is a decentralized cross-chain liquidity protocol that allows users to swap assets between different blockchains (e.g., Ethereum to Bitcoin) without KYC or centralized oversight. This makes it harder for authorities to freeze funds.

Q3: What is the current status of the TrustedVolumes hack investigation?
The investigation is ongoing. PeckShield and other blockchain security firms are monitoring the movement of funds. No arrests have been made, and the identity of the hacker remains unknown.