The number was wrong. Not the headline — 464 ETH routed into Tornado Cash, a figure clean enough to survive a hundred retweets and a dozen aggregator posts. The wrong number was the remainder.
Four hundred and sixty-four. The largest pool in Tornado Cash holds 100 ETH. Four deposits of that size move 400. Sixty-four remains. And 64 does not exist as a denomination in the protocol. The pools are fixed and unforgiving: 0.1, 1, 10, and 100 ETH. There is no sixty-four.
So the operator did one of two things. Split the remainder across smaller pools — a 10 here, a 1 there — until the arithmetic balanced. Or route it through another address entirely: a second intermediate hop, a fifth wallet, a bridge to another chain. Either way, the round number in the news report conceals a decision that a careful launderer had to make by hand, wallet by wallet, at three in the morning, watching a block explorer refresh.
That decision is the story. Not the theft. The theft is ordinary, and it has been ordinary for a decade. The decision is where the operator's tradecraft becomes legible — where a person who intended to be invisible left a fingerprint in their own arithmetic. Silence before the block confirms the truth. This one, before it was even mined, had already said too much.
Context
To understand what happened to CryptoBilis — a centralized exchange whose hot wallet was drained and whose funds then walked into the largest privacy mixer on Ethereum — you have to understand what Tornado Cash is and, more importantly, what it is not.
Tornado Cash launched on mainnet in 2019. Its design is elegant and, in the way of the best cryptographic tools, almost boring. A user deposits a fixed denomination into a pool. The deposit generates a secret note. Later, an unrelated address presents a zero-knowledge proof — specifically a zk-SNARK, a zero-knowledge succinct non-interactive argument of knowledge — demonstrating that the presenter holds a valid note without revealing which deposit it corresponds to. The withdrawal comes from a different address. On the surface, the link between deposit and withdrawal is severed.
The mechanics matter because the entire investigative story rests on a single distinction. Tornado severs the cryptographic link. It does not sever the statistical one.
A zk-SNARK proves a statement without revealing the witness. In Tornado's case, the statement is "I know a secret corresponding to some unspent deposit in this pool." The witness is the note itself. The proof is sound, the cryptography is real, and none of it addresses the question a chain analyst actually asks, which is not "can you prove which deposit is yours" but "can I infer which deposit is yours from everything else."
That everything else is metadata, and metadata is not protected by the proof. It is protected — imperfectly — by the size of the crowd.
The amounts themselves are a fingerprint. Fixed denominations are Tornado's privacy feature: they collapse all deposits into identical chunks so that no observer can trace a unique sum. But the same rigidity creates a constraint. To move 464 ETH, an operator must compose that sum from available bricks — four hundreds, six tens, four ones, or some other combination. Each brick is a separate deposit, a separate note, a separate withdrawal. The privacy of the pool is the privacy of the crowd, and the operator has to join the crowd in exactly the right increments.
CryptoBilis, for its part, has disclosed almost nothing. We know a hot wallet was compromised. We know the funds moved. We do not know the total loss, the timestamp, the mechanism of the breach, or whether the exchange can cover customer withdrawals. That silence is itself a data point, and I will return to it.
The protocol does not lie; the interface does. And the interface here is the assumption of anonymity that surrounds the word "mixer." Tornado Cash is a mixer in the way a bank vault is a hiding place. It keeps things safe from the casual observer. It does not make them disappear.
Core Analysis
Here is what the on-chain record actually shows. A source address controlled by the attacker held the stolen funds. From that source, 464 ETH moved to an intermediate address. From the intermediate address, the funds fanned out into four deposit wallets. From those four wallets, the ETH entered Tornado Cash pools.
The structure is deliberate. This is not a novice dropping a lump sum into a mixer and hoping. This is layering — the second of the three classic stages of money laundering, placement, layering, integration — executed with an awareness of how chain analytics actually works.
Let me be precise about why the structure matters, because the details are where the tradecraft lives.
Chain analytics firms — Chainalysis, TRM Labs, Elliptic — do not break zk-SNARKs. They cannot, and they do not try. What they do is clustering. They build graphs of addresses linked by behavioral features: shared gas funding, temporal proximity, identical transaction patterns, common counterparties, and deposit-and-withdrawal timing that correlates across pools. The proof hides the witness; the graph reconstructs the actor.
The intermediate address defeats the most naive clustering heuristic, which is "the same address deposited and withdrew." A single wallet that both funds and withdraws is trivially linked, proof or no proof. Adding an intermediate hop forces the analyst to link two addresses instead of observing one.
The four deposit wallets defeat the second heuristic, which is "one deposit wallet maps to one withdrawal." By splitting 464 into four streams, the operator forces an analyst to correlate five addresses instead of one — and to do so across the noise of a pool with a large anonymity set. This is the difference between a needle in a haystack and four needles arranged in a pattern.
This is competent tradecraft. It is not sophisticated. And the difference matters enormously, because it tells us what the operator knew and what they feared.
Based on my audit experience, I have learned to read the gap between what an operator knows and what an operator fears. In 2017, when I spent six weeks disassembling the Gnosis Safe multi-sig contract at the assembly level, the lesson was not about the vulnerability itself. The lesson was about the shape of the mistake. The people who wrote that contract were competent, and the flaw was not incompetence. It was a blind spot — a place where the author's mental model of the system diverged from the system's actual behavior under adversarial conditions.
The same shape appears here. A genuinely sophisticated launderer would not stop at four wallets. They would use a relayer to pay gas from a third-party address, severing the gas-funding link that most clustering algorithms still lean on as a primary heuristic. They would vary deposit timing across days rather than hours, because temporal clustering is cheap and effective. They would avoid round-number compositions that survive as a signature in a press release. They would, in short, treat the mixer as one layer of a multi-layer process rather than as the process itself.
This operator did some of that — the intermediate address, the four-way split — but left enough correlation surface that investigators could reconstruct the path and publish it. They understood the first-order defenses and neglected the second-order ones. That is the most useful single fact in the entire event, and it is the one nobody is reporting.
Now the residue. The source address still holds approximately 700 ETH. This is the part of the story that is still live, and it is where I would focus if I were advising the exchange or the exchanges downstream.
Why leave 700 ETH behind? Three hypotheses, each with a different implication for what happens next.
First, staged laundering. The operator is moving funds in tranches, watching whether the first 464 triggers a freeze or an alert before committing the rest. This is patient behavior, and it implies either a longer time horizon or a nervousness about exposure. An operator who is confident dumps everything at once. An operator who is watching the reaction moves in waves.
Second, a withdrawal bottleneck. Tornado Cash pools do not have a hard capacity limit in the code, but they have an effective one in the economics of privacy. The anonymity set constrains how much can move without collapsing the cover. Dumping 1,164 ETH at once — the full haul — would shrink the effective crowd and increase correlation risk, because the pool would fill with the operator's own deposits. To hide a needle, you need hay, and the operator is waiting for the hay to accumulate. This is the most technically literate explanation, and it is the one I find most plausible.
Third, and least comfortable for everyone involved: the 700 ETH is not under single control. It may represent a split between multiple parties, and a disagreement about how to move it has stalled the operation. This happens more often than the industry admits. Heists are frequently the work of small crews, and crews disagree about risk.
I cannot distinguish between these three from public data. What I can say is that the residue is a clock. Every block that passes without the 700 moving is a block in which the operator is deciding something. Certainty is a bug in a stochastic world; here, the uncertainty is not a flaw in the analysis. It is the analysis.
The arithmetic of the 464 also deserves a second look, because it reveals the operator's process, not just their intent. Four hundred is four clean 100 ETH deposits. The remaining 64 has to be assembled by hand. If it went in as six tens and four ones, that is ten additional deposits and ten additional notes — ten additional withdrawal events to manage, ten additional correlation points scattered across two smaller pools with smaller crowds. A careful operator would not want that many moving parts, because each part is a place to make a mistake. A less careful one might not have thought about it at all.
The fact that the remainder exists at all suggests the operator prioritized speed — dumping the bulk in round chunks — over the marginal privacy gain of a cleaner composition. Speed is a signal. Speed suggests either confidence or time pressure, and in my experience, time pressure is more common than confidence in the hours after a breach. People who have just stolen millions do not feel calm. They feel hunted, and hunted people move fast, and fast people leave remainders.
There is one more technical thread worth pulling, and it is the one that makes this event more fragile for the operator than it looks. Tornado's fixed denominations mean that the 100 ETH pool has the largest anonymity set in absolute terms but, in relative terms, the fewest participants. Most users move smaller amounts. The 10 ETH pool and the 1 ETH pool are crowded with retail traffic — ordinary privacy users, arbitrage bots, and people moving modest sums. The 100 ETH pool is where the whales swim, and whales are rare.
An operator who deposits four hundreds is betting that the 100 ETH pool is crowded enough to hide in. That bet may be wrong. If investigators can enumerate the 100 ETH deposits in the relevant window and subtract the ones with clean provenance — deposits whose source addresses are known, funded from known exchanges, belonging to known users — the four CryptoBilis hundreds stand out like a signature. The privacy of the large pool is a function of how many other whales are moving that day. On a quiet day, the operator is not hiding among thousands. They are hiding among a handful, and a handful is a list, and a list is a target.
To own the chain is to own the history. Every deposit is a permanent public record. The zk-SNARK hides the cryptographic link between a note and a withdrawal. It cannot hide the fact that four wallets deposited 400 ETH into the 100 pool on a given day. That fact lives on-chain forever, available to anyone with a block explorer, a spreadsheet, and patience. The proof is a lock on one door. The building has many doors.
This is why I keep returning to the phrase "half-professional." The operator defeated the obvious heuristics and then chose the pool with the thinnest crowd. They used an intermediate address and then left a remainder that exposes their process. They moved fast and then stopped, leaving 700 ETH to be watched. Every strength is paired with a weakness, and the weaknesses are all of the same kind: they are second-order. They are the things you learn only after you have made the first-order mistakes a few times.
The Contrarian Angle
The reflexive conclusion — "the funds are gone, Tornado Cash made them untraceable" — is exactly backwards, and the reason it is backwards is the most important thing in this article.
The funds were traced. Publicly. An investigator reconstructed the source, the intermediate address, the four deposit wallets, and the mixer entry, and published the path. If Tornado Cash provided the anonymity its reputation implies, that path would not exist. The fact that we are reading about the four deposit wallets at all is proof that the mixer failed to fully anonymize this specific flow.
This is not an argument that Tornado Cash is broken. It is an argument that anonymity is a spectrum, not a switch, and that the mixer sits at the strong end of the spectrum without reaching the end of it. The tool works. It just does not work the way the word "mixer" suggests, and the gap between the two is where every misunderstanding about this event lives.
The deeper contrarian point is about compliance status, and here the conventional narrative is genuinely confused. Tornado Cash was sanctioned by OFAC in August 2022. In November 2024, the Fifth Circuit ruled that OFAC had exceeded its authority in doing so. In March 2025, OFAC removed Tornado Cash from the SDN list. So the act of routing funds through the mixer is, at the time of writing, no longer a sanctions violation in itself.
And yet. Every exchange compliance desk still flags Tornado Cash interactions as high risk. Every chain analytics firm still tags them. The delisting changed the legal status. It did not change the operational reality. A deposit address that receives funds withdrawn from Tornado still faces freeze risk at most major centralized exchanges, because the risk function at a compliance desk is not "is this sanctioned" but "can we defend this to a regulator when it goes wrong." Vested interest distorts the lens of analysis, and the vested interest here is institutional caution.
So the operator faces a strange equilibrium. The legal prohibition lifted. The operational prohibition did not. The mixer is, in 2026, simultaneously more legal and less usable than it was in 2023. That is the paradox no one is writing about, and it is the one that will shape where the 700 ETH goes next. A rational operator reading the same compliance landscape I am reading would conclude that the mixer is no longer a clean exit. It is a flag. And flags attract attention.
There is a second layer to the contrarian reading, and it concerns the tool's developers rather than its users. Alexey Pertsev was convicted in the Netherlands. Roman Storm faced criminal proceedings in the United States. The people who wrote the code that this operator used are, themselves, the subject of a years-long legal experiment about whether writing privacy software is a crime. That experiment is unresolved, and it hangs over every future interaction with the protocol. An operator choosing Tornado Cash in 2026 is choosing a tool whose legal status is clearer than it was but whose social status is not.
Which brings me to the silence from CryptoBilis. An exchange that has been drained has an obligation — to its users, and honestly to the industry — to disclose the scale and the mechanism. The absence of disclosure is informative. In my work auditing custodial key management for institutions, the failures I found were rarely sophisticated. They were convenience decisions: hot wallets with too much balance, keys without proper separation, multi-sig thresholds set for speed rather than safety, signing ceremonies compressed to fit a deadline. When an exchange goes quiet after a breach, my prior shifts toward a mundane cause and an embarrassing one. The silence protects the exchange's reputation, not its users.
Takeaway
Watch the 700 ETH. Not because it is large — it is not, roughly two to three million dollars at recent prices, a rounding error against Ethereum's daily volume — but because its next move is a decision the operator has not yet made, and decisions reveal more than actions.
If the 700 splits into more Tornado deposits across several days, the operator is patient and probably professional-adjacent, and the funds are likely gone for good. If it jumps to a cross-chain bridge, the operator is optimizing for speed, and the trail may fork into multiple jurisdictions — complicating recovery but also multiplying the chances of a KYC checkpoint at a bridge or exchange on the far side. If it simply sits, the operator is either waiting or divided, and the exchange still has a window, however narrow.
The larger lesson is structural, and it predates this event and will outlast it. The arms race between chain analytics and privacy tooling is not converging on a winner. It is oscillating. Each new clustering heuristic is answered by a new obfuscation technique; each new obfuscation is answered by a new heuristic. The CryptoBilis trail is one frame in that loop — a half-professional operator defeated by a half-professional analyst, both improving, neither finished.
We build in the dark to light the public square. But the dark is also where the money moves, and it does not announce itself. The only honest position is to keep reading the chain, block by block, and to treat every clean headline number as a hypothesis rather than a fact.
The 464 did not divide evenly. That remainder is where the truth lives. Go find it.