Voltage Finance Hacker Moves Stolen ETH to Tornado Cash

Following a period of inactivity, the perpetrator behind the 2022 Voltage Finance exploit, which resulted in losses exceeding $4.67 million, has transferred a portion of the stolen Ether (ETH) to the privacy-enhancing platform Tornado Cash. This recent activity was first highlighted by blockchain security firm CertiK.

According to CertiK’s May 6th report on X (formerly Twitter), the transaction involved approximately 100 ETH, valued at roughly $182,783 at the time of the transfer. While the ETH originated from a different address than the one initially linked to the exploit, CertiK traced it back to the same hacker.

CertiK’s investigation revealed that the exploit in March 2022 leveraged a reentrancy attack targeting a vulnerability in the ERC677 token standard’s built-in callback function. This allowed the hacker to drain a substantial amount of funds from Voltage Finance’s lending pool.

The stolen funds included a mix of stablecoins and other cryptocurrencies, such as USDC, BUSD, WBTC, and ETH, as Voltage Finance reported at the time.

The address used to send the funds to Tornado Cash remained dormant for approximately 166 days before this recent transaction, as confirmed by Etherscan data. Voltage Finance previously publicly stated they had contacted exchanges to block transactions from the attacker’s flagged address and attempted negotiations for the return of stolen funds.

Subsequent Attacks and Recovery Efforts

It is important to note that Voltage Finance faced another exploit on March 18th, affecting its Simple Staking pools. This resulted in an additional $322,000 in stolen funds. Voltage Finance offered a $50,000 bounty for the return of funds in this incident and launched an internal investigation.

The recent activity underscores the ongoing challenges in tracking and recovering assets from DeFi exploits, even with the use of blockchain analysis and collaboration with law enforcement.

Related: Crypto Hacks Double in April