In the ever-evolving saga of the KuCoin exchange hack — one of the largest cryptocurrency heists in history — the attacker has taken a bold new step. On October 23, 2020, blockchain analysts discovered that the hacker behind the $275 million KuCoin breach was actively using the Ethereum mixer Tornado Cash to launder stolen funds, moving millions of dollars worth of ETH through the privacy protocol in a calculated effort to cover their tracks.
TL;DR
- The KuCoin hacker sent approximately 11,520 ETH (roughly $4.8 million) to Tornado Cash mixer on October 23, 2020
- Analysts tracked 2,800–3,000 ETH ($1.16–$1.25 million) already mixed in batches of 100 ETH
- The hacker’s wallet still held around 8,517 ETH ($3.55 million) pending transfer
- The laundering process involves converting stolen ERC-20 tokens to ETH via Uniswap and Kyber Network before mixing
- The Block analyst Larry Cermak believes the public nature of the transactions may actually aid law enforcement
The Hack That Shook the Crypto World
The original breach occurred on September 25, 2020, when hackers exploited KuCoin’s hot wallets and made off with more than $275 million in various cryptocurrencies. The attack immediately ranked among the top three largest exchange hacks in crypto history at the time, sending shockwaves through the community and raising fresh questions about centralized exchange security.
KuCoin’s CEO Johnny Lyu addressed the incident in a livestream the following day, assuring users that the exchange would cover all losses through its insurance fund. The exchange gradually resumed services as the investigation unfolded, but the trail of stolen funds continued to develop in the weeks that followed.
Following the Money Through Tornado Cash
On October 23, Larry Cermak, Director of Research at The Block, revealed that the KuCoin hacker had begun routing significant amounts of stolen Ethereum through Tornado Cash, a decentralized privacy protocol on the Ethereum network. The mixer works by pooling deposits from multiple users and redistributing them, making it extremely difficult to trace the origin of specific funds.
According to Cermak’s analysis, the attacker transferred approximately 11,520 ETH — worth roughly $4.8 million at the time — into Tornado Cash. Of that amount, between 2,800 and 3,000 ETH (approximately $1.16 to $1.25 million) had already been processed through the mixer in methodical batches of 100 ETH each. The hacker’s primary wallet still held approximately 8,517 ETH, equivalent to about $3.55 million, suggesting the laundering operation was far from over.
A Sophisticated Laundering Pipeline
Blockchain researchers pieced together the hacker’s entire money movement strategy, revealing a multi-step process designed to maximize obfuscation:
- Token Theft: Steal ERC-20 tokens directly from KuCoin’s compromised wallets
- Conversion: Swap the stolen tokens for ETH using decentralized exchanges like Uniswap and Kyber Network
- Dispersal: Distribute the ETH across multiple wallet addresses to complicate tracking
- Mixing: Feed the ETH through Tornado Cash to break the on-chain trail
- Cash Out: Eventually convert the mixed ETH to fiat currency through various means
This pipeline highlights a growing concern in the DeFi ecosystem: the same decentralized protocols designed for financial freedom can also serve as tools for money laundering when exploited by bad actors.
Analyst Reactions and Implications
Developer Udi Wertheimer noted that if the hacker continued at the current pace, they could eventually control as much as a third of Tornado Cash’s total mixing pool — a concentration that would be notable in its own right. However, Cermak offered a counterpoint, suggesting that the hacker’s use of Tornado Cash from a publicly identifiable address might actually work against them.
“Very high likelihood of [them being caught],” Cermak wrote, characterizing the approach as a “horrific” operational security failure. The transparency of blockchain transactions means that even when mixers are employed, patterns can emerge that help investigators follow the money trail over time.
This incident also underscored a broader tension in the cryptocurrency space between privacy and transparency. Tornado Cash and similar protocols exist to provide legitimate financial privacy for users, but high-profile cases like the KuCoin hack inevitably draw regulatory scrutiny and could influence future legislation around privacy-preserving technologies.
Why This Matters
The KuCoin hack and its aftermath represent a critical case study in crypto security and the cat-and-mouse game between hackers and investigators. At the time of these transactions, Bitcoin was trading at approximately $12,931 and Ethereum at around $409.77, with the broader crypto market capitalization exceeding $300 billion. The incident demonstrated both the vulnerabilities of centralized exchanges and the double-edged nature of DeFi infrastructure. For users, it served as a stark reminder of the importance of self-custody and due diligence when choosing where to store digital assets. For the industry, it highlighted the urgent need for better security practices across both centralized and decentralized platforms.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research before making any investment decisions.
11,520 ETH through Tornado Cash in batches of 100. Larry Cermak was right that the public nature of these transactions actually helps investigators more than it helps the hacker
Cermak was right. the on-chain footprint from Tornado batching is permanent. OFAC sanctioned the mixer later but the analysis trail never disappeared
Converting ERC-20 tokens to ETH via Uniswap and Kyber before mixing. $275M hack and the laundering process was methodical but not untraceable
converting ERC-20 tokens through Uniswap and Kyber before mixing. $275M hack and the laundering relied on the same DEXs everyone uses daily
Norbert F. Uniswap and Kyber swapping stolen ERC-20s no questions asked. the same DEXs everyone praises for being permissionless were the laundering infrastructure
dex_paradox_ Uniswap and Kyber processed stolen ERC-20s without a single compliance check. permissionless is great until its your funds being laundered
Norbert F. spot on. DEXs are double-edged. same liquidity that makes DeFi useful makes laundering trivial. uniswap didnt ask questions before swapping stolen ERC-20s
batches of 100 ETH through Tornado was slow but methodical. the 8517 ETH sitting in that wallet was eventually traced anyway. mixing is not anonymous
fog_machine mixing is not anonymous was proven correct. OFAC sanctioned Tornado two years later and every deposit became a permanent trail
chain_forensics_ the 0.1 ETH gas cost per deposit is a good catch. 11520 ETH in 100 batch sizes means at least 115 deposits. chainalysis just mapped every single one
fog_machine the 100 ETH batch size was deliberate. amounts under the reporting threshold for most mixers at the time. attacker knew the limits better than most devs
Dmitri K. the 100 ETH batches were under reporting thresholds but Tornado had a 0.1 ETH deposit gas cost. attacker lost a chunk just in fees moving 11520 ETH
Larry Cermak said the public transactions might help law enforcement and he was right. the hacker used Tornado but OFAC sanctioned the mixer later anyway. privacy tools get punished for existing
11,520 ETH through Tornado in 100 ETH batches. took weeks and still traceable. Tornado delayed the inevitable but KuCoin and chainalysis tracked most of it eventually
11520 ETH through Tornado in 100 ETH batches and still traceable. Larry Cermak called it from day one. privacy tools dont erase on-chain history they just delay the analysis
11,520 ETH through Tornado in 100 ETH batches and Cermak still tracked most of it. privacy tools delay analysis they dont erase it. the OFAC sanction two years later just made the trail more visible
$275M hack and the cleanup took months. imagine the resources kucoin burned on chain analysis alone. thats the hidden cost nobody talks about
11520 ETH in 100 ETH batches took weeks to process. the attacker had patience but chainalysis had more. time always favors the tracker
batch_trace_ 11520 ETH through Tornado in 100 ETH batches and Cermak still tracked it. privacy tools just delay analysis they dont stop it
batch_trace_ 100 ETH batches under the reporting threshold took weeks of patience. chainalysis had months. time favors whoever has more of it
batch_trace_ patience only works until chainalysis builds the cluster map. 100 ETH batches slowed them down but the on-chain fingerprint of every Tornado deposit is permanent. time favors the tracker not the attacker
8517 ETH sitting unmixed for weeks because every batch risked exposure. the operational overhead of laundering 275M is the real deterrent, not the mixer itself
mixer_dust_ those 8517 ETH sitting unmixed for weeks proves the bottleneck was operational patience not the mixer itself
uniswap_mixer the real bottleneck was converting ERC20s to ETH before mixing. Uniswap and Kyber were the actual laundering tools not Tornado itself