The attacker behind the Triple-A treasury theft transferred 4,970 ETH, worth about $12.4 million, into Tornado Cash, a cryptocurrency mixing service that obscures transaction trails. Salus said the funds were moved across chains to Ethereum and exchanged before being split between two intermediary addresses on Sept. 6. On Oct. 9, the attacker consolidated the funds through a single wallet and deposited them into Tornado Cash across 56 transactions: 49 transfers of 100 ETH and seven transfers of 10 ETH. One funding flow also included an earlier withdrawal from the mixer. The attacker stole Triple-A’s own treasury assets in July, with publicly estimated losses of about $11.8 million. Triple-A previously said customer funds were not affected.