In November 2023, more than half of the $100 million worth of Ethereum linked to the notorious Poloniex hack was seized through the Tornado Cash privacy protocol. On November 10, 2023, significant unauthorized withdrawals were recorded from wallets belonging to the crypto exchange Poloniex. Investigations later confirmed that over $100 million worth of Ethereum was lost due to a hack.
What is Happening at Poloniex?
Despite the hacker claiming weeks later to have identified the culprit and offering a $10 million reward, the stolen funds never returned to the exchange. According to blockchain security firm CertiK, the incident was likely a private key compromise. In response to suspicious withdrawals, the exchange temporarily disabled the compromised wallet.
Six months later, it became clear that the Poloniex hacker had no intention of returning the stolen money. Blockchain research firm PeckShield discovered that more than half of the stolen funds were transferred to Tornado Cash, a protocol used to anonymize assets.
As shown in the flowchart above, the hacker moved over 17,800 Ethereum from six different wallets to a single Tornado Cash address. During the transfer, the tokens were valued at approximately $53.3 million.
Poloniex Team Takes Notable Step
Poloniex resumed operations shortly after the $100 million disruption, allowing investors to deposit and withdraw cryptocurrencies at any time. The exchange appointed a top-tier security audit firm to enhance the security of funds on Poloniex and prevent such attacks in the future. At the time, they shared the following statement:
“They are currently in the final stages of security auditing and verification processes for Poloniex. Upon completion of the audit, we will immediately resume deposit and withdrawal services on our platform.”
Justin Sun, the owner of Poloniex who acquired the exchange in 2019, claimed that Poloniex maintained a healthy financial status and was seeking cooperation with other exchanges to recover the lost funds, promising full compensation to users affected by the breach.
