The attacker linked to the Transit Finance exploit deposited 832.9 ETH, worth about $1.8 million, into Tornado Cash (crypto mixing service) from an Ethereum address starting with 0x9db8, according to CertiK (blockchain security firm). The transfer was monitored on May 21. Transit Finance was hacked on May 13, and about $1.88 million was stolen. Moving funds through a mixer can make blockchain-based tracing more difficult, a common post-exploit step in crypto theft cases.