Nomad Bridge hacker moves $35.2M in ETH to Tornado Cash

A Nomad Bridge exploiter-labeled address has transferred 14,500 Ether, worth approximately $35.2 million, to Tornado Cash, a popular cryptocurrency mixing service. 

According to an X post by PeckshiedAlert, funds linked to the August 2022 Nomad Bridge hack were transferred on Aug. 8.

However, the transfer of 14,500 Ether (ETH) follows another notable transaction on Aug. 5, when 16,892 ETH was bought using stolen funds linked to Nomad Bridge.

This hack exploited the crypto bridge Nomad, leading to the loss of substantial funds. The Aug. 5 purchase occurred during a dramatic drop in Ether’s value, falling over 20% from around $2,760 to $2,172 in less than 12 hours.

The Role of Tornado Cash

Tornado Cash is a decentralized, non-custodial privacy solution on the Ethereum blockchain that uses zero-knowledge proofs to break the onchain link between the source and destination of funds. While the service is designed to provide privacy for legitimate users, it has also become a tool for cybercriminals looking to launder stolen cryptocurrencies.

The case of the Nomad Bridge exploiter is not isolated. Recently, the hacker behind the Rain crypto exchange attack also began laundering stolen Ether through Tornado Cash. This trend underscores the dual-use nature of privacy tools in the cryptocurrency space.

Regulatory and Legal Responses

The persistent use of Tornado Cash by malicious actors has not gone unnoticed by regulators. In 2022, the United States Treasury Department blocklisted Tornado Cash, leading to significant scrutiny and legal actions against its developers.

A report from the Federal Reserve Bank of New York on the impact of sanctions on Tornado Cash concluded that sanctions are generally effective even in decentralized finance. The report, however, highlighted the “fragility” of the Ethereum network’s resistance to censorship and its cooperation with regulatory measures.

Tornado Cash remains operational, experiencing a notable uptick in usage, even as it faces sanctions. Meanwhile, the legal situation has shifted, with developer Alexey Pertsev convicted of money laundering in the Netherlands in May.

In a related development, the US Department of Justice has charged Tornado Cash developers Roman Storm and Roman Semenov with conspiracy to commit money laundering, sanctions violations, and operating an unlicensed money-transmitting business.

As the crypto industry evolves, finding a balance between privacy and security remains critical. The use of mixing services like Tornado Cash by hackers not only jeopardizes the security of digital assets but also threatens the trust and stability of the broader cryptocurrency ecosystem