Tornado Cash used to launder $500,000 stolen from DAO Maker last year: security firms

Quick Take

A hacker routed $500,000 of DAI stablecoin through Tornado Cash today.
The funds were stolen during an exploit of crowdfunding platform DAO Maker in August 2021.

An Ethereum address connected with an exploit last year of DAO Maker has laundered 500,000 DAI stablecoins through Tornado Cash, security firms PeckShield and CertiK said today.

DAO Maker (not to be confused with stablecoin project Maker DAO) is a crowd fundraising platform that suffered a hack in August 2021. Because of a bug in DAO Maker’s smart contract, a hacker was able to steal more than $7 million in stablecoins. These funds were then scattered across different addresses controlled by the hacker.

A year after the incident, one of the addresses, which was labeled by Etherscan as the exploiter of DAO Maker, has transferred $500,000 worth of DAI stablecoins through Tornado Cash. Hackers often funnel stolen assets through Tornado Cash because it allows them to obscure the transactional activity.

Tornado Cash has been in the spotlight in recent weeks, since it was sanctioned by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC). Following the sanctions, all US-based individuals and entities are prohibited from interacting with the app, given its potential for money laundering.

Still, even after the sanctions were announced, Tornado Cash has continued to experience usage by hackers of decentralized finance protocols, as seen today and in other recent events.

On Aug. 19, PeckShield detected that an address responsible for a December 2021 exploit of Grim Finance moved almost $3.3 million into Tornado Cash. Then on Sept. 6, the exploiter of MonoX Finance laundered $2.1 million via Tornado Cash.