Another wallet drain, another trip through Tornado Cash. Blockchain security firm CertiK has flagged deposits into the privacy mixer that it links to an address tied to the theft of about $1.58 million from victims.
The figure has been rounded up to roughly $2 million in some coverage. Either way, the money appears to be following a well-worn path: stolen, then swiftly sent somewhere harder to follow.
What CertiK found
According to CertiK, the address in question recently drained about $1.58 million worth of digital assets. The firm then spotted deposits from that address into Tornado Cash.
The incident lines up with a suspected private-key compromise reported around October 27, 2026. A private key is the master password to a crypto wallet. Whoever holds it controls the funds, no questions asked and no customer service line to call.
That detail matters. This does not appear to be a smart contract bug or a flaw in a specific protocol’s code. CertiK’s findings point instead to a direct breach of a wallet or multisig setup.
A multisig is a wallet that needs several approvals before funds can move. When those keys leak, the safeguard stops being much of a safeguard.
No specific tokens have been named in connection with the drained assets. The victims have not been publicly identified either.
A familiar laundering route
Tornado Cash is a mixer. It pools deposits from many users and lets them withdraw to fresh addresses, which breaks the visible link between sender and recipient on the blockchain.
CertiK has described a pattern in which stolen funds are routed through mixers like Tornado Cash shortly after a theft. The latest case fits that template neatly.
On October 20, an exploiter behind an attack on an Aztec rollup reportedly deposited $3M into Tornado Cash, according to the research compiled on these incidents.
Multiple incidents in 2026 have seen Tornado Cash flagged as a laundering stop for post-theft assets. Two cases roughly a week apart in late October suggest the habit is not fading.
The bigger security picture
CertiK’s quarterly reporting offers some context. Its Q3 2026 data indicates that private-key compromises made up a significant share of smaller thefts and the losses tied to them.
The firm’s ranking of top incidents excludes phishing attacks, following its stated methodology. In September 2026, exploits recorded both the highest losses and the largest number of incidents in CertiK’s tracking.
What this means for users and the industry
The most direct lesson is about key management. If private-key compromises keep accounting for a meaningful slice of thefts, the weakest link is often operational rather than technical.
For security firms like CertiK, the job increasingly looks like real-time surveillance. Flagging mixer deposits quickly gives exchanges and investigators a chance to watch for funds that later resurface.
What to watch next: whether the victims or affected tokens are identified, whether any of the roughly $1.58 million can be traced after leaving Tornado Cash, and whether CertiK’s Q4 data shows private-key compromises continuing to rise.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.