Analyst Ties Another 3,500 ETH Tornado Cash Transfer to Pando Rings Attacker

On-chain analyst 余烬 has linked another transfer of 3,500 Ether (ETH), worth approximately $7.42 million, through the Tornado Cash mixing service to the attacker behind the Pando Rings exploit. The movement was tied to wallet address 0x303...3d9F and was observed around 9:28 a.m. ET (14:28 UTC) on Monday, Nov. 9.

The two figures describe a single transaction from two angles. The 3,500 ETH is the size of the transfer on the chain itself; the $7.42 million estimate is its reported dollar valuation at the time of the observation. For perspective, that single movement is roughly 150 times the median American household's annual income moving through a mixer in one transaction.

What exactly did the analyst report?

The analyst characterized the transfer as another laundering move tied to Pando Rings, a phrasing that carries weight. The word "another" signals prior activity: earlier transfers associated with the same attacker have already been tracked through Tornado Cash, according to the analyst's framing. The address was published only in shortened form — 0x303...3d9F — a standard practice in on-chain analysis that lets observers verify the wallet without displaying the full identifier.

The report rests on on-chain observation rather than any official attribution. No law enforcement agency, court filing, or protocol team has publicly corroborated the link between the wallet and the Pando Rings incident.

Why does Tornado Cash matter here?

Tornado Cash is an Ethereum-based privacy protocol that obscures the connection between sending and receiving addresses. Funds deposited into it cannot be trivially traced onward, which makes it a recurring endpoint for attackers seeking to sever the audit trail between a hack and any cash-out. Its use does not prove guilt on its own, and lawful users deploy it for ordinary privacy reasons. In practice, however, investigators treat large post-exploit deposits as a strong signal that stolen funds are being prepared for disposal or moved beyond easy recovery.

The operational consequence for Pando Rings and any affected parties is straightforward. Once funds cycle through a mixer, the practical window for freezing them at exchanges or via coordinated blacklisting narrows considerably. Recovery after mixing typically depends on the attacker making an operational mistake — depositing to a regulated venue, or consolidating into a watched address — rather than on direct tracing.

What remains unverified?

Several material facts sit outside the analyst's report. The source does not state the total amount drained from Pando Rings, does not say how much previously linked Tornado Cash activity preceded this transfer, and does not identify whether any exchange or chain-analytics firm has flagged the receiving side. The dollar valuation of $7.42 million also reflects the market price at the time of observation; ether's volatility means the figure shifts with the market.

Attribution, in short, currently rests on one named analyst's on-chain tracing. That is a common and often reliable basis for this kind of finding, but it remains an analytical claim, not a legal one.

In plain words: another multi-million-dollar slice of funds tied to the Pando Rings attacker has been pushed through a mixer, and with each pass the practical odds of recovery tighten.