The attacker tied to Triple-A’s July treasury breach has moved 4,970 ETH, worth about $12.4 million, into Tornado Cash, according to blockchain security firm Salus.

Salus said the activity took place on Oct. 9 and involved funds that were first routed through intermediary addresses before reaching a single wallet that made the final deposits. Triple-A has previously said the earlier breach affected treasury reserves, while customer funds held in separate trust accounts were not impacted.

Salus traces deposits into mixer

Salus linked the Tornado Cash transactions to the attacker behind the Triple-A incident, describing two streams of funds that were funneled through intermediary wallets before being consolidated.

According to the firm, the wallet then made 49 deposits of 100 ETH and seven deposits of 10 ETH into Tornado Cash on Oct. 9. In total, the transfers amounted to 4,970 ETH, or roughly $12.4 million at the time cited in the report.

Movement follows July treasury breach

The latest transfers come months after Triple-A disclosed a breach involving its treasury assets. Earlier tracing had already indicated that Ethereum was the destination network for assets taken from the company’s wallets.

Triple-A said at the time that the incident did not affect customer money because those funds were kept in separate trust accounts. The company framed the impact as limited to its own treasury reserves.

Company cited social engineering and response measures

Triple-A said social engineering allowed the attacker to gain access to operational systems. In response, the company said it brought in cybersecurity specialists and blockchain-forensics experts to investigate the breach, trace the stolen assets, and support recovery efforts.

It also said remediation steps included tighter access controls, restrictions on credentials, broader monitoring, and continued tracing work. The company added that potential freezing actions remained part of the response.

What is confirmed next

The confirmed on-chain development so far is the movement of the stolen ETH into Tornado Cash, as identified by Salus. Triple-A has said tracing and recovery efforts are ongoing, but no further outcome was described in the source material.

That leaves the next documented step centered on whether investigators can continue following the funds after the mixer transactions and whether any freezing or recovery actions materialize.

Source: crypto.news