One Wallet, 4,970 ETH, and the Fingerprint Triple-A's Attacker Gave Away for Free

Forty-nine deposits of 100 ETH. Seven deposits of 10 ETH. One wallet routing both streams. That is the complete operational signature of the attacker who drained Triple-A's treasury, and it is one of the sloppiest anonymization strategies I have seen from someone who clearly understood what a mixer was for. On October 10, a single address pushed 4,970 ETH — roughly $12.4 million at the time of transfer — into Tornado Cash. The move was structured, patient, and deliberate. It was also self-defeating. The same address that was supposed to erase the trail instead became the strongest clustering node in the entire chain of custody. Panic is just a mispriced option on volatility — but this was not panic. This was a calculated error, and calculated errors leave the cleanest forensic breadcrumbs. Let me get the context right before going deeper, because the label matters more than the dollar figure. Triple-A is a stablecoin payment infrastructure — a licensed settlement layer sitting between issuers like Circle and the merchants and enterprises that need to move value across borders. That positioning is the whole story. A payment gateway is a trust business. Its product is the promise that funds moving through it are safe. When roughly $11.8 million was stolen on July 27, the loss was not the headline. The headline is that a company whose core asset is client settlement capital lost control of that capital. There is a data discrepancy worth flagging, and it is the kind of detail that separates a lazy reader from a useful one. The initial theft is reported at approximately $11.8 million. The transfer amount is reported at 4,970 ETH, valued near $12.4 million. That is a positive $600,000 gap — the attacker did not lose money. They gained it. The only mechanism that explains this is ETH price appreciation between theft and transfer, which implies a spot price near $2,495 at the moment of the October move. The attacker sat on stolen inventory for roughly 75 days and, by doing nothing, added about $600,000 of mark-to-market profit. Liquidity is the only truth in a thin book, and here the book told us something the attacker never intended to disclose: their entry price and their exit window. Now the mechanics. This is where the analysis gets interesting, because the money laundering is textbook — and textbook is exactly the problem. Tornado Cash does not accept arbitrary amounts. It runs fixed-denomination pools: 0.1, 1, 10, and 100 ETH. Anyone wanting to use it must fragment their balance into those exact sizes. The 49 × 100 ETH and 7 × 10 ETH split is a perfect match to that constraint. The attacker was not being creative; they were being compliant with the mixer's architecture. That tells me two things. First, the 100 ETH pool likely has a per-transaction ceiling that forced the split into 49 separate deposits. Second, that fragmentation extended the operation's time window — precisely the window where on-chain monitoring firms earn their fees. Then there is the recycling trick. One of the two routing paths contained funds that had previously been withdrawn from the same mixer. This is chain-hopping — mixing already-tumbled coins with fresh ones to manufacture a false "this money was clean once" history. It is a real technique. It is also the kind of technique that only works if the two streams never touch a common address. They did. Both paths ran through a single wallet. Alpha is hunted in the noise, and the attacker handed the hunters a reference point so obvious it is almost insulting. That single-wallet routing is the core insight of this entire event, so let me be precise about why it matters. On-chain analysis works by clustering — grouping addresses that provably belong to the same entity. The strongest clustering signal is a shared intermediary. When you funnel two distinct fund flows through one address, you have just told every analytics firm, every exchange compliance desk, and every law-enforcement dashboard that both flows share a controller. Salus, which tracked the entire movement, did not need advanced heuristics. They needed one graph edge. An operation whose stated goal was anonymity produced the single most traceable fingerprint available. Volatility is the tax you pay for entry, not exit — and this attacker paid that tax in forensics. The 75-day gap between theft and transfer fits a known behavioral pattern: let the news cycle cool, let the incident drop off feeds, then move. It is a rational waiting strategy. It is also, in this case, a gift. Those 75 days gave monitoring firms time to build the complete address map before a single ETH hit the mixer. Here is where the conventional read gets it wrong, and I want to push against it hard. The reflexive takeaway from any Tornado Cash story is "mixers make recovery impossible." That framing misses the actual risk. The funds have not completed a full tumbling cycle — there is no observed clean withdrawal yet. That means the current window, the first two to four weeks after the transfer, is the golden tracking period, not the post-mortem. The mixer is a delay mechanism, not an eraser. The bigger story is what the single-wallet error reveals about the attacker: this is not a nation-state APT. Lazarus-grade operations route through multi-hop bridges, burner wallets, and timing randomization. This attacker knew the tool but not the tradecraft. Mid-tier actor. Mid-tier discipline. The genuinely under-priced risk is not this attacker. It is the vulnerability class. The attack vector was never disclosed — no word on whether this was a private-key compromise, a contract flaw, an insider, or a front-end hijack. That silence is the finding. A payment infrastructure holding client settlement capital lost eight figures, and the industry still does not know how. Based on my own audit experience reviewing hot-wallet controls, the most common defect in this sector is exactly the one nobody documents: a cold/hot split that exists on paper but collapses to a single signer in practice. If that is the root cause here, then every stablecoin payment gateway running the same assumptions is exposed. The most dangerous thing about an $11.8 million loss is a second company that has not yet learned it shares the flaw. There is a second blind spot, and it is temporal. The reporting never states the year. That is not a minor omission; it is decisive. Tornado Cash was sanctioned by OFAC in August 2022 and delisted in March 2025. If this transfer happened inside the sanctions window, the attacker committed sanctions evasion under US long-arm jurisdiction. If it happened after the delisting, the compliance picture changes entirely. Same on-chain facts, two completely different legal worlds. You cannot assess the regulatory risk of this event without the year, and the reporting omitted it. I treat missing timestamps the way I treat missing liquidity — as a reason to distrust the whole quote. So what do you actually do with this? Watch the withdrawal side, not the deposit side. The clean funds will exit Tornado Cash in structured batches over one to three months. Those exits are the traceable events. Flag any exchange deposit address receiving funds originating from this cluster, because that is where the money either gets frozen or gets laundered into fiat. And watch for a second payment-infrastructure incident carrying the same signature — because if the vulnerability is systemic, the next headline is already being written. The heist is over. The tracking window is open. Most people have already stopped looking.