The Pando Rings Hacker Just Woke Up After Four Years
Nov 3, 2026
A dormant wallet tied to the old Pando Rings exploit just moved roughly 4,000 ETH through Tornado Cash after four quiet years, reviving the hunt to track where the funds go next.
A Wallet That Went Quiet for Years Just Moved Again
Back when the Pando Rings oracle exploit happened, the attacker grabbed a pile of ETH and then basically vanished. No big cash-outs, no sloppy mistakes, just a wallet sitting there collecting dust for four years.
That changed this week. On-chain trackers spotted the exploiter wallet waking up and sending roughly 4,000 ETH through Tornado Cash, the privacy mixer that has become the go-to laundering tool for hackers trying to break the trail between stolen funds and a cash-out.
Why Investigators Are Watching Closely
The moves have reportedly come in smaller batches rather than one big dump, a pattern that makes it harder for chain analysts to tie the mixed funds back to a single destination. It is a reminder that old exploits do not just disappear once the headlines fade, the money is often still sitting there, waiting for the right moment to move.
For now, there is no sign the funds have hit an exchange, but that is usually the next step worth watching.