Major Movement of Stolen Funds: 4,970 ETH Enters Privacy Protocol
Blockchain security monitor Salus raised an alert on X platform on October 10th, as its tracking system detected significant asset movement from addresses linked to the Triple-A exploit. A total of 4,970 Ether (approximately $12.4 million at the time) was deposited into a well-known privacy-enhancing protocol through a series of transactions.
Timeline of the Exploit and Fund Flow
The security incident originated in July of this year. The attacker compromised the internal vault of payments service provider Triple-A, siphoning off a substantial amount of crypto assets. Public estimates place the losses around $11.8 million.
Following the theft, the attacker executed a multi-stage process to obfuscate the funds:
- Cross-Chain Transfer & Swap: The initially stolen assets were bridged to the Ethereum network and swapped.
- Address Splitting: On September 6th, the funds were dispersed into two separate intermediary addresses.
- Consolidation: After over a month of inactivity, the attacker merged the dispersed funds back into a single wallet on October 9th.
A Structured Deposit Pattern
Immediately after consolidation, the attacker initiated the final phase. A total of 56 deposit transactions were sent to the privacy protocol in a short timeframe, following a distinct pattern:
- 49 large transactions of 100 ETH each.
- 7 smaller transactions of 10 ETH each.
Security analysts noted that a portion of these funds included assets previously withdrawn from another mixing service. This "nested" or "chained" method is a common tactic to obscure the origin of funds and break the on-chain trail.
This movement represents a critical phase in the post-exploit money laundering process for the Triple-A incident. While privacy protocols are legitimate tools, such large-scale, structured deposits are frequently associated with attempts to sanitize illicit proceeds, posing an ongoing challenge for crypto compliance and AML surveillance.