Hackers who attacked WazirX exchange causing $235 million in losses continue to launder crypto through Tornado Cash mixer, with orders to transfer up to $6.5 million.

Blockchain security platform Cyvers announced on September 3 that hackers in the WazirX attack transferred 2,600 ETH (equivalent to $6.5 million) via Tornado Cash, a popular cryptocurrency mixing tool for hackers.

The incident occurred in India, where the WazirX exchange is in the process of recovering operations after a $235 million attack in July. According to data from DeBank, the hacker made 26 separate transactions, each worth 100 ETH, within an hour.

Hackers transferred $6.5 million to Tornado Cash. Source: DeBank

WazirX had earlier announced that it would allow users to withdraw up to 66% of their Indian rupee (INR) token balances from the exchange, a week earlier than expected. However, 34% of the INR balances have been “frozen” due to investigations.

The exchange also said it is facing legal issues related to cryptocurrency withdrawals and is in the process of legal restructuring in Singapore.

The hackers’ use of Tornado Cash to hide the source of the stolen funds has once again raised the alarm about the potential for money laundering in the cryptocurrency sector. Regulators around the world are facing an increasing challenge in monitoring and preventing illicit activities involving cryptocurrencies.

Tornado Cash was added to the US Treasury Department's sanctions list in August 2022 for allegedly facilitating money laundering, including for the Lazarus Group, a hacker group believed to be linked to North Korea.