Term Labs Attacker Deposits 300 ETH to Tornado Cash

The use of Tornado Cash is the tell here: it signals the attacker is prioritising obfuscation over speed, which typically means the funds are not being held for a quick negotiated return. For DeFi protocols generally, it also highlights that even after an exploit is identified, on-chain tracing often stalls once funds enter a mixer. Whether exchanges and analytics firms can flag any downstream withdrawal addresses is the open question, since that is where enforcement pressure usually lands.