Pando Rings-Linked Wallet Sends 4,000 ETH to Tornado Cash

A wallet linked to the November 2022 Pando Rings exploit sent 4,000 ETH, valued at about $9.17 million, to Tornado Cash, according to transaction activity reported by Lookonchain. The exploit itself stole about $20 million.

How did the wallet acquire the Ether?

Earlier in November, the wallet converted 16.7 million Dai (DAI) into 7,548 ETH, an acquisition then valued at about $16.72 million, Lookonchain said. It subsequently sent 4,000 of those ETH to Tornado Cash in a new transaction.

The 4,000 ETH deposit represented slightly more than half of the purchase. The other 3,548 ETH were not included in the reported Tornado Cash deposit, and the report does not describe where they went. That separates the reported transaction trail into assets sent to the mixer and 3,548 ETH outside that deposit.

Why does Lookonchain suspect an effort to obscure the funds?

Lookonchain characterized the transfer as a “suspected effort to route and obscure the funds through Tornado Cash,” which the report describes as a mixing protocol. The wording matters: the source identifies a tracking assessment, not a court finding, criminal charge or regulatory conclusion.

The operational concern is the sequence. The wallet reportedly converted 16.7 million DAI into ETH and then sent a majority of the acquired balance through a mixing service. Lookonchain also tied the address to the 2022 theft, making the latest movement part of the reported disposition of exploit proceeds rather than an isolated mixer deposit.

Lookonchain’s attribution also stops short of naming the wallet operator. The available report identifies no wallet address, arrest, asset seizure or court filing tied to the 4,000 ETH transfer.

It therefore supports a narrow conclusion: Lookonchain viewed the movement as an attempt to obscure the funds’ route, but the cited material attributes no criminal conduct to a named person or entity.

What activity came before?

• The same address moved 800 ETH through Tornado Cash in August.
• It also sold 6,240 ETH in June for more than $290,000 in profit.

Those transfers stretch across several months, and the report says they remain tied to funds from the 2022 Pando Rings exploit. The latest 4,000 ETH movement therefore extends a multi-month pattern of selling, conversion and mixer transfers linked to the same address, rather than a first interaction with Tornado Cash.

For market participants, the distinction between the two dollar values is also material: $16.72 million measures the full ETH acquisition, while $9.17 million measures only the portion sent to Tornado Cash. The figures should not be added because they describe the same funds at different stages.

What remains unresolved?

The report does not give the exact date of the new transfer, the year attached to the June, August and November transactions, or a destination for the 3,548 ETH outside the reported deposit. It also identifies no exchange intervention, attribution of the operator through analytics or enforcement response.

This leaves the compliance issue open. A mixer transfer inserts another layer between the theft-linked wallet and the funds’ later path, which is the operational risk Lookonchain highlighted. The source provides no evidence that the mixed ETH has been recovered or frozen.

The next verifiable checkpoint is whether the excluded 3,548 ETH is transferred again or is linked to a disclosed seizure, freeze or enforcement filing; no deadline appears in the available report.