Triple-A Attacker Moves 4,970 ETH Worth $12.4M Into Tornado Cash

The migration into Tornado Cash signals that the attacker has moved past the consolidation phase and is now actively working to obscure the trail, a step that typically precedes attempts to cash out through off-ramps. That the deposits were split across dozens of transactions suggests deliberate structuring to avoid triggering automated monitoring thresholds. For Triple-A, the distinction between customer funds and its own vault losses may limit the immediate liability question, but the laundering pattern keeps the incident live in compliance and law-enforcement channels. Whether any portion of these funds is traced and frozen before it exits mixing is the open question.