A wallet tied to the 2022 exploit of Pando Rings became active again on August 18 after about two months of inactivity, according to blockchain tracker Onchain Lens. The address swapped 3 million DAI for roughly 1,570 ETH through CoW Protocol, reactivating attention on funds still linked to the old attack.

About 800 ETH, valued at roughly $1.52 million, was then sent from the wallet to Tornado Cash in eight transactions. The transfers do not erase the connection to the earlier exploit, but they do mark a new phase in the handling of funds associated with the breach.

Fresh movement from an old exploit

The latest activity centers on funds tied to the November 5, 2022 hack of Pando Rings. On that date, the attacker manipulated the price of an sBTC-WBTC liquidity provider token on 4swap, Pando’s automated market maker, and used the distorted price feed in an attempt to extract about $70 million in crypto.

Pando said that by the time action was taken, around $21.9 million in ETH, EOS, and BTC had already been moved out of two Mixin wallets controlled by the attacker. Not all of the affected assets were lost: Pando worked with Mixin Network and cybersecurity firm SlowMist to freeze remaining funds, including 2,022,662 EOS worth about $2.36 million and other tokens with a combined valuation above $50 million.

From stablecoins into ether

This week’s wallet activity followed a pattern seen before. The exploiter exchanged 3 million DAI for about 1,570 ETH, a trade worth roughly $3 million at the time, before beginning to route part of the ether onward.

The same address had also resurfaced earlier in the year. A June 6 report from Lookonchain said the wallet spent 10 million DAI to buy 6,243 ETH at an average price of $1,602. The August 18 transfers suggest a continued strategy of converting stablecoins into ETH and then deciding when to move those holdings further.

Tornado Cash receives 800 ETH

What stands out in the latest round is the destination. Instead of simply holding the ether, the wallet sent around 800 ETH to Tornado Cash, splitting the amount across eight deposits. Tornado Cash is commonly used to make the link between deposits and withdrawals harder to follow.

Even so, moving funds through a mixer does not necessarily make them invisible. The source article points to a June case tracked by TRM Labs in which about 664 ETH withdrawn from Tornado Cash was later used in an attack involving the Ethereum-based TOP project. That example underscores that mixer use can still leave transactions under scrutiny, especially when large amounts are involved.

Pando’s shutdown adds timing questions

The renewed wallet activity came just days after Pando announced, on August 15, that it was discontinuing the protocol and placing its DeFi products into maintenance mode under Mixin’s supervision. According to the announcement described in the source, Pando Rings now only supports loan repayment and collateral withdrawals.

After the 2022 exploit, Pando had already halted services including Pando Rings, 4swap, Pando Leaf, and Pando Lake while the oracle issue was addressed, while also saying customers would be reimbursed. The latest transfers therefore arrive as the project is moving toward a limited end-state rather than a recovery of normal operations.

A reminder of DeFi’s long-tail risk

The case highlights how exploit proceeds can remain dormant for long periods and then move again years later. Although oracle manipulation once caused major DeFi losses, the source article says such incidents have become far less common as protocol design improved.

Immunefi’s six-year loss analysis, as cited in the report, found that ecosystem-style attacks such as flash-loan oracle manipulation fell from nearly 19% of DeFi loss incidents in 2022 to less than 1% in 2025. For now, the confirmed next step is limited to what has already been observed on-chain: the wallet has reactivated, converted DAI into ETH, and sent 800 ETH into Tornado Cash while the remaining history of the funds continues to be monitored.

Source: Cryptopolitan