Stolen funds moved through Tornado Cash and found their way to two exchange addresses.

Zach XBT, the online sleuth, said that since 2023, a new pattern has been noticed in the movement of stolen coins by hackers. Zach said that most of these funds ended up at two exchange addresses.

A clear trend

In a Twitter post on July 20, the online investigator showed how the $60 million Anubis hack followed the same pattern.

“I noticed a clear trend in 2023 of funds being withdrawn from Tornado Cash and bridged to Polygon before consolidating into two exchange accounts.”

He further announced that a user on Twitter, Beerus (bsl.eth), recently sent 70 ETH to one of the addresses. After the post, Beerus’ friend Ersan, who controls the address, wrote in broken English.

“How do I know it’s illegal? Every day, I take a lot of money from different people.  I just do money exchanges for small profit. What do you want me to do?”