Four hundred and sixty-four ETH walked into Tornado Cash, and the price of Ether did not blink.
No candle. No liquidation cascade. No trending topic. By every metric the market uses to decide what deserves attention, this was nothing — a rounding error inside a settlement layer that moves tens of billions of dollars a day. And yet it is the single most instructive thing to happen on-chain this month, because it is a perfect specimen of a machine most people still misunderstand: the laundering pipeline that hums quietly underneath the market everyone watches.
Here is what we actually know, stripped to the bone. A wallet tied to the CryptoBilis theft pushed 464 ETH into Tornado Cash. The funds did not arrive there directly. They passed through an intermediary address, then fanned out across four separate deposit wallets before being dropped into the mixer. The originating address still holds roughly 700 ETH. That last number is the one I keep circling back to, because it is not an accounting detail. It is a clock.
I have spent enough nights staring at block explorers to know that the interesting part of a heist is never the heist. It is the exit. The entrance is loud and the exit is where discipline shows. And the exit here has a shape — a very specific, very legible shape — and that shape tells you more about the attacker than any headline ever will.
Context: A Tool the World Tried to Kill
To understand why 464 ETH matters, you first have to understand what Tornado Cash actually is, because the version of it that lives in most people's heads is a caricature.
Tornado Cash is a smart contract on Ethereum that breaks the on-chain link between where money comes from and where it goes. You deposit a fixed amount — historically 100, 10, 1, or 0.1 ETH — and receive a cryptographic note. Later, a different address presents that note and withdraws the same amount, minus a fee, to anywhere it likes. A zero-knowledge proof does the work: it convinces the contract that you are entitled to a withdrawal without revealing which deposit was yours. The contract holds no admin key, no upgrade switch, no kill code. Once deployed, it is as permanent as the chain it sits on.
That permanence is the whole story.
In August 2022, the U.S. Treasury's Office of Foreign Assets Control added Tornado Cash to the SDN list — the first time a piece of immutable software, rather than a person or an entity, had been sanctioned. Developers were arrested: Alexey Pertsev in the Netherlands, Roman Storm in the United States. Pertsev was later sentenced to 64 months. The message was meant to be unmistakable: build privacy infrastructure and the state will come for you personally, not for your code, because your code cannot be handcuffed.
And then the courts pushed back. In November 2024, the Fifth Circuit ruled in Van Loon v. Treasury that OFAC had overstepped — you cannot sanction an immutable smart contract the way you sanction a person, because there is no one to sanction, nothing to seize, no property to freeze in the sense the statute requires. By early 2025, Tornado Cash had been removed from the sanctions list.
Read that timeline twice, because most of the market read it exactly once and drew the wrong conclusion. I will come back to that, but hold the shape of it: a tool that was banned, that got unbanned, and that never once stopped working.
On the other side of the ledger sits CryptoBilis — and here the information thins out fast. There is no meaningful public profile of the platform. No clear jurisdiction, no disclosed team, no token that I can verify, no audited architecture I can point to. The name itself may not be native English; "Bilis" carries different meanings in different languages, and that should make any researcher careful about search results. I am not going to pretend I know things I do not know. What I can say is that a platform with no public face and no visible security posture is exactly the kind of platform where user funds have no meaningful backstop. When the money left, nothing and no one stood in the way.
Core: The Shape of the Exit
The CryptoBilis flow is textbook, and that is precisely why it is worth dissecting. Textbook is not boring. Textbook is legible, and legible is how you learn to read the whole genre.
What the trail shows is a combination of two classic layering techniques. The first is a peel chain — a large sum moved through a sequence of addresses, each hop forwarding most of the balance and shedding a little, like peeling layers off a piece of fruit. The second is a fan-out — a single address splitting into many, so that the money no longer has a single path a researcher can trace end to end. Deployed together, they defeat the naive assumption that money has one addressable route from crime to cash. The observed structure — source address, intermediary address, four deposit wallets, then the mixer — is exactly this pattern, compressed into a few hops.
But the four deposit wallets deserve a closer look, because they are not arbitrary. Tornado Cash accepts fixed-denomination deposits. You cannot feed 464 ETH in as a single lump; the protocol forces you to decompose the amount into standard units. And 464 decomposes cleanly: four hundreds, six tens, four ones. Four hundred, plus sixty, plus four. That is 464 exactly. So the four-wallet structure is not decoration and it is not paranoia. It is the arithmetic of the protocol asserting itself on the attacker's behavior. The tool shapes the crime, and the on-chain footprint is a fossil of the tool's constraints.
I want to flag my confidence here, because the internet is full of people presenting inference as fact and I refuse to be one of them. That denomination decomposition is my inference from the protocol's historical scheme. It is consistent with the observed four-wallet fan-out, but it is not stated anywhere in the source. What is stated is simpler and firmer: 464 ETH went in, routed through an intermediary, split across four wallets. I am giving you the arithmetic because it explains the shape, not because I have wallet-level data in front of me. The difference between those two things is the difference between analysis and performance.
Now the concept that actually determines whether laundering works: the anonymity set. Tornado Cash's privacy is not absolute. It is statistical. Your withdrawal is hidden inside the crowd of everyone else who deposited and withdrew around the same window. The bigger the crowd, the better the cover. The smaller the crowd, the more your withdrawal stands out like a lit window in a dark building.
Which means the attacker's real problem is not the deposit. It is the timing of the withdrawal. Deposits are cheap and public; withdrawals are where anonymity is either won or lost. If you pull 100 ETH into a fresh wallet at 3 a.m. on a quiet Sunday, in a window when only three other people used the 100 ETH pool, you have not laundered anything — you have simply republished your transaction with extra steps and a cryptographic bow on top. The proof hides the link. The crowd hides the person. No crowd, no hiding. This is the part that every breathless thread about mixers skips, and it is the only part that matters operationally.
Which brings me back to the 700 ETH still parked in the source address. That number is the most interesting figure in the entire story, and it is interesting for three reasons at once.
First, it tells you the heist was larger than what was laundered. If 464 ETH went into the mixer and roughly 700 ETH remains, then the total haul is at least 1,164 ETH. The launderer has, at this point, processed less than half of it. The job is unfinished.
Second, it tells you the strategy. Cleaning in tranches is rational. It spreads anonymity-set risk across time, so that no single pool window is flooded with a conspicuous 1,100 ETH of fresh criminal inflow. It keeps optionality open — if the first tranche gets flagged, the rest is still clean and in hand. And it hedges against exactly the scenario that terrifies a careful launderer: being early, and being alone in the pool.
Third, and most importantly, it means the operation is live. A dormant address is a cold case. A funded address that is actively being drained is a beacon. Every day that 700 ETH sits there is a day that exchanges, analytics firms, and law enforcement get to build their maps, pre-tag the likely next hops, and coordinate. The clock is not a metaphor. The residue is a live target, and it is the single largest piece of unfinished business in this story.
There is a deeper reason Tornado Cash still works at all, and it is not the one people usually give. It is not that hackers love privacy as a value. It is that the contract is immutable. You can sanction a front-end, a domain, a GitHub org, a human being. All of that happened. But there is no switch to flip on the contract itself. It keeps accepting deposits because there is nothing to turn off. Code is not law; it is a negotiation, and this particular contract negotiated its way out of the reach of the state by refusing to have a throat to grab. That is the design, and the design is doing exactly what it was built to do — for better and for worse, and it turns out the worst gets the headlines.
Now consider the withdrawal side, because that is where the next chapter gets written. The deposit is public and permanent. The withdrawal is where the money becomes spendable, and it is where the trail can, in principle, be picked back up. Analytics firms do not need to break the zero-knowledge proof. They never do. They watch the pool, they watch the exits, and they build probabilistic maps from timing, amounts, and downstream behavior. The mixer hides a single link; it does not hide a pattern. A launderer who withdraws into a wallet that then pays a known exchange deposit address has simply moved the problem one hop downstream. The anonymity set buys time and distance, not immunity.
And here is the market that nobody advertises: the surveillance industry. Chainalysis, Arkham, Elliptic — these are the mirror image of Tornado Cash, and they grow on the same transactions. Every event like this is a live product demo. As laundering gets more sophisticated, forensics gets more valuable, and the two industries expand in lockstep, feeding on the same on-chain events. This is not a conspiracy theory. It is a market with two sides, and both sides get paid when a theft happens.
I want to bring in something I have watched from the inside, because it bears directly on how this ends. I have sat on both sides of the compliance desk. I have watched a fintech firm spend months and a serious budget wiring identity verification into a custody product, chasing a regulatory standard that looked rigorous on paper. And I have also watched how trivially that same wall is walked around by anyone who genuinely wants to. A determined launderer does not submit a passport to a centralized exchange. They buy a wallet with history, or they route through a handful of self-custody hops, or they simply never touch a KYC surface at all. The cost of compliance does not land on the person it is meant to stop. It lands on the honest user who now has to upload a utility bill to move their own money. The attacker pays nothing. The compliant pay everything. That asymmetry is not a bug in the current regime. It is the regime, and every case like CryptoBilis makes it more expensive for the people who were never the problem.
People sometimes ask why criminals do not simply launder through Bitcoin's Lightning Network, which is supposedly the cheap, fast, private rail. The answer is that Lightning has been half-dead for seven years, and it is half-dead for precisely the reasons that make it useless for this purpose. Routing fails constantly. Channel liquidity is a management nightmare. In practice the network collapses toward a handful of custodial hubs that are trivially identifiable and trivially compelled. You cannot launder through a network that struggles to route an ordinary payment. The attackers use Ethereum and Tornado Cash not because they love Ethereum, but because the tooling actually works. Reliability beats ideology, even for criminals.
There is one more economic layer here, and it is the one that hides in plain sight: fan-out costs money. Every extra address in a peel chain is another transaction, another fee, another slice of gas. The cheaper blockspace becomes, the cheaper obfuscation becomes. Rollups have driven settlement costs down dramatically, and post-Dencun blobspace turned fees into a rounding error for exactly this kind of multi-hop activity. But blobspace is a finite resource, and the consumption math is unforgiving. Within a couple of years, the same congestion that once gripped the base layer will grip the data-availability layer, and the cost of every one of those fan-out hops will rise again. Cheap blockspace is a subsidy for everyone, and everyone includes the people you would rather not subsidize. When the subsidy ends, the friction returns — not to the attacker specifically, but to all of us, honest and dishonest alike, sharing one bill.
Contrarian: The Delisting Was Not a Win for Privacy
Everyone framed the Tornado Cash delisting as a victory for the cypherpunks. I think that is backwards, and the CryptoBilis case is the evidence.
What actually happened in the courts was a clarification of the boundary of state authority. The state cannot sanction an immutable contract, because there is nothing there to sanction. Fine. But the state can, and does, watch every deposit and withdrawal. It can lean on the exchanges where the money eventually tries to land. It can subpoena, coordinate, and freeze. The delisting did not remove the state's reach; it removed a blunt instrument that was politically expensive and legally shaky, and left behind a precise instrument that is quiet, legal, and growing. The blunt instrument made noise and lost in court. The precise one does not need to make noise. It just needs to wait.
Meanwhile the privacy track pays for every incident. Every time stolen funds touch a mixer, the same headline writes itself, and it becomes ammunition in the next legislative hearing. The good use cases — the dissident, the journalist, the ordinary person who simply does not want their salary visible to their landlord or their employer — get buried under the same four letters. Privacy technology does not get to choose its users, and that is the tragedy of the whole category: it is judged by its worst customer, forever, in public.
And the honest user, once again, foots the bill. Surveillance tightens at the KYC surface, where the criminal is not. The compliant user pays in friction and in exposure, while the actual launderer skips the line entirely. Idealism without audit is just gambling, and the current compliance model is gambling on the wrong person being honest.
The real winners of the CryptoBilis trail are not the cypherpunks and not the hackers. They are the analytics firms, whose product value gets validated in public every single time this happens, and the regulators, who get a fresh anecdote for free.
Takeaway: A Clock, Not a Fact
The 700 ETH is a clock, not a fact. It is the part of the story that has not finished being written, and it is the part worth watching. Not because I expect a dramatic arrest, but because the way this residue moves will tell us something we do not yet know: whether the industry's surveillance machinery has actually gotten good enough to make the exit as dangerous as the entrance. Truth emerges from the chaos of the bear, and the bear is where discipline gets tested — for builders, for launderers, and for the watchers.
I have no interest in predicting the price impact of a single theft, because there is none worth speaking of. 464 ETH is a rounding error against daily volume, and anyone who tells you it is a trading signal is selling you something. The signal is elsewhere. It is in the fact that a contract the world tried to kill is still quietly doing business. It is in the fact that a platform no one can quite identify lost user funds with no visible backstop. It is in the fact that the cost of protecting honest people keeps rising while the cost of hiding from the rules stays near zero.
So watch the residue. Watch the exits, not the deposits. Watch whether the next tranche moves into a crowded pool or a quiet one, because that single choice reveals how sophisticated this operator really is. And watch the exchanges, because the moment that money tries to become spendable is the moment this stops being a story about privacy and becomes a story about whether anyone is actually holding the line.
Decentralization is a verb, not a noun. It is not a property a contract has; it is a thing a community does, every day, in public, under pressure. The CryptoBilis trail is a stress test of that verb — and the question it leaves us with is not whether the attacker gets caught. It is whether the rest of us finally start treating the exit with the same seriousness we reserve for the entrance.