Hook
The chart didn't break. The wallet did.
464 ETH walked out of a wallet tied to CryptoBilis and straight into Tornado Cash. Not one clean transfer โ an intermediate address, then four separate deposit wallets. That's the version the aggregators ran. Here's the version they buried: the source address still holds roughly 700 ETH. Untouched.
Four hundred sixty-four out. Seven hundred still sitting there. Both numbers are on-chain. Both are verifiable inside a minute. Only one of them tells you what actually happened.
Context
Tornado Cash isn't new. It's been running since 2019 โ a fixed-denomination mixer on Ethereum that uses zk-SNARKs to sever the link between a deposit address and a withdrawal address. You drop in 0.1, 1, 10, or 100 ETH. Later, an unrelated address pulls out the same amount. The zero-knowledge proof guarantees you deposited without revealing which deposit was yours. That's the design. That's also the fingerprint.
CryptoBilis is the victim here, and I want to be precise about what that means. The source material doesn't confirm whether it's a centralized exchange, a custody provider, or something else entirely. What it confirms is that funds left its control and entered a laundering pipeline. That distinction matters, and I'll flag it rather than paper over it. If CryptoBilis holds user deposits, the downstream risk is a withdrawal run. If it's a treasury, the risk is contained. Nobody has published which.
The regulatory backdrop is the part most readers will get wrong. Tornado Cash was sanctioned by OFAC in August 2022 โ added to the SDN list. In November 2024, the Fifth Circuit ruled that OFAC had overstepped its statutory authority. By March 2025, Treasury had pulled Tornado Cash from the SDN list entirely. So when I say 464 ETH went "into Tornado," I'm not describing an illegal act under current US sanctions law. I'm describing an act that will still light up every chain-analytics dashboard in the industry. Legal and flagged are not opposites. They're two different columns, and they now point in opposite directions.
The tool's developers have paid for that ambiguity. Alexey Pertsev was convicted in the Netherlands. Roman Storm faces criminal trial in the US. The protocol runs; the people who built it are in court.
That gap is the story. Not the theft.
Core
Let me trace the mechanics, because the structure is where the intent lives.
A first-hop attacker wallet receives the 464 ETH. It doesn't go straight to Tornado. It goes to an intermediate address. From there, the funds split across four deposit wallets. Each of those wallets, presumably, feeds a separate Tornado pool.
The intermediate address matters more than it looks. It's a hop, but a hop does work. It separates the theft wallet from the deposit wallets, so a clustering flag on the deposit side doesn't propagate upstream to the origin. One hop, one degree of separation removed.
Why bother with the split? Because a single wallet depositing 464 ETH into one pool is a confession. The anonymity set is only useful if you blend into it. Four wallets, staggered timing, mixed denominations โ that's layering, the second stage of the classic placement-layering-integration model, and it exists for exactly one reason: to break correlation clustering.
Now, how does clustering actually work? Chain-analytics firms don't crack zk-SNARKs. They attack the metadata around the proof. Deposit and withdrawal timing. Gas price fingerprints. Relayer selection. The way amounts are split. If a deposit goes in at 14:03 and a withdrawal comes out at 14:07 from a wallet funded moments earlier, the math doesn't need to be perfect โ the correlation is enough. Layering defeats correlation by making the pattern fuzzy. Four wallets, four pools, staggered clocks. It's not elegant. It's effective.
Here's where the numbers get interesting. 464 is not divisible by 100. It's 4ร100 plus 64. Tornado's pools are fixed at 0.1, 1, 10, and 100 ETH. You cannot deposit 464 ETH into 100-ETH pools and get a clean result. So either the operator mixed pool sizes โ four 100-ETH notes, six 10-ETH notes, four 1-ETH notes, and so on โ or there's additional routing the public trail hasn't captured yet. Either way, "464" is not a round number, and round numbers are what careful launderers aim for. A clean 400 or 500 would blend better. The remainder is a seam, and seams are where investigators pull the thread.
Based on my audit experience tracing fund flows after the FTX collapse, this is a familiar shape. In November 2022, I watched $600 million in USDC move from FTX wallets to Alameda addresses, and the tell was never the headline amount โ it was the awkward leftovers. Funds that didn't quite fit the pattern. The 64 ETH here is that same kind of leftover. It's small. It's also the most informative number in the entire event.
Then there's the gas question. Tornado withdrawals typically route through a relayer โ a third party that fronts the gas so the withdrawal address never touches ETH directly. That's standard anti-forensics. If the withdrawal wallet received gas from a wallet connected to the deposit side, the whole exercise collapses. A relayer breaks that link. I can't confirm one was used here from the source material, but the structure โ intermediate address, four deposit wallets โ is consistent with someone who knows the playbook. This is not a script kiddie. This is someone who has read the tracking methodology and built around it.
Which brings me to the 700 ETH.
Everyone is fixated on the money that moved. The money that didn't move is louder. A source address holding 700 ETH, post-theft, is telling you one of three things. One: the operator is washing in tranches, watching for monitoring triggers before committing the next slice โ patient, deliberate, professional. Two: there's a withdrawal obstacle, a timelock, a multisig dispute, a key that won't sign. Three: multiple parties are splitting the take and haven't agreed on the cut.
Each of those implies a different attacker. A lone professional with a plan looks like one. A crew with a governance problem looks like another. A compromised operation with a stuck key looks like a third. The 700 ETH is the diagnostic. Watch it.
And one more thing the feeds missed. Tornado Cash being off the SDN list does not make its output clean. Chain-analytics firms โ Chainalysis, TRM โ still flag every interaction. Centralized exchanges that receive flagged deposits will freeze first and ask questions later. So the real exit path isn't Tornado-to-cash. It's Tornado-to-a-CEX-that-doesn't-look-closely, or Tornado-to-a-bridge, or Tornado-to-OTC. The mixer hides the trail. It does not launder the reputation. Those are different problems, and the operator now has both.
Contrarian
Here's what nobody is writing. The interesting question isn't how the attacker hid the 464. It's why the attacker left the 700 in plain sight.
Reading the room in the order book silence tells you the same thing every time: the move that didn't happen is the signal. Every instinct says move everything fast. Speed over precision when the chart breaks โ that's the rule I trade by, and it's the rule most thieves follow too. This one didn't. The residual balance is either discipline or dysfunction, and the market can't tell which yet. If it's discipline, we're watching a professional deliberately feeding the mixer in doses to stay under alert thresholds โ the same logic as a whale splitting orders to avoid moving a price. If it's dysfunction, we're watching a compromised operation, and the 700 is a liability the attacker can't deploy.
There's a third read, and it's the one I'd put money on. The 700 isn't the attacker's to move yet. If CryptoBilis still controls part of that wallet's key material โ say, a multisig where the attacker holds only one share โ then the residual balance is frozen by disagreement, not choice. That explains the patience better than professionalism does. You don't leave 700 ETH idle because you're careful. You leave it idle because you can't spend it.
The industry also keeps misreading the regulatory moment. Tornado delisted from the SDN list reads, in headlines, like a win for privacy. But delisting removed the sanctions stick without removing the forensic marker. That's arguably worse for operators. Under sanctions, a Tornado interaction was a legal line โ crossed or not, binary, defensible. Now it's a reputational line, drawn by private analytics firms, enforced by exchange risk teams with no court and no appeal. The rulebook got fuzzier and the enforcement got faster. Privacy tools didn't win in March 2025. They traded a legal risk for an operational one.
Takeaway
Watch the 700. Not the 464 โ that's already gone, already mixed, already someone else's problem. The residual balance is the live wire. If it splits and enters Tornado in the next reporting window, the operator is professional and the money is unrecoverable. If it sits, someone is stuck, and stuck is where recoveries start.
Chasing the alpha while the market sleeps means reading the balance nobody refreshes. The next signal here isn't on a price chart. It's a wallet that hasn't moved.