ZachXBT linked the funds to two private key leak incidents, saying the attacker used Circle's CCTP to move USDC across chains and route it to seven Arbitrum deposit addresses.
A hacker withdrew about 3,200 ETH from Tornado Cash between July 2 and 3 in activity ZachXBT tied to two private key leak incidents. The attacker then used Circle's CCTP (Cross-Chain Transfer Protocol) bridge to move about $5.5 million across blockchains and sent USDC to seven deposit addresses on Arbitrum. The flow suggests a coordinated laundering path, with privacy infrastructure and cross-chain transfers used to complicate tracing.