CertiK (blockchain security firm) says the transfer from an Ethereum address beginning with 0x9db8 was monitored on May 21, days after Transit Finance lost about $1.88 million in a May 13 hack.
The attacker linked to the Transit Finance exploit deposited 832.9 ETH, worth about $1.8 million, into Tornado Cash (crypto mixing service) from an Ethereum address starting with 0x9db8, according to CertiK (blockchain security firm). The transfer was monitored on May 21. Transit Finance was hacked on May 13, and about $1.88 million was stolen. Moving funds through a mixer can make blockchain-based tracing more difficult, a common post-exploit step in crypto theft cases.