Penpie Hacker Launders Last Batch of the Stolen $27M Ether

• Penpie hacker has laundered all the funds stolen from the DeFi platform.
• The hacker transferred the stolen ETH to Tornado Cash in batches.
• Penpie has doubled down on its efforts to recover the funds.

The Penpie hacker has moved millions in Ether to Tornado Cash , effectively transferring all the stolen funds to the crypto mixer.

On September 3, the hacker exploited Penpie’s security vulnerability, seizing control of users’ funds and stealing over $27 million in assets across the Arbitrum and Ethereum networks. Penpie attributed the attack to a reentrancy protection vulnerability in the Pendle staking market.

Hacker’s Laundering Activity

According to blockchain security firm PeckShield, the hacker started moving the stolen funds on September 6, transferring 7,262 ETH ($17.4 million) to an intermediary address. The intermediary address laundered 5,600 ETH ($13.4 million) via Tornado Cash, followed by a series of other transfers to the crypto mixer, totaling 9,600 ETH ($23 million).

Barely two days later, on September 8, the hacker transferred the last 1,661 ETH to Tornado Cash, following the same transaction pattern used earlier. The funds were first deposited to the intermediary address before being distributed in small transfers of 100 ETH to the crypto mixer.

The hacker has since laundered all the stolen Ether despite Penpie’s efforts to recover the funds. On September 4, the DeFi platform wrote to the malicious actor, saying it was willing to negotiate a bounty for the safe return of funds without legal action or identity revelation.

After the hacker ignored the plea, Penpie announced a $2.7 million bounty on September 6, 10% of the stolen funds. The DeFi platform said it would pay the bounty from the recovered funds.

Meanwhile, the Euler Finance exploiter congratulated the hacker for the “good job,” noting that they “didn’t see a hack like this for a while.”

Stay updated on how much hackers stole from the crypto industry in August:
Hackers Steal $313.86M in Crypto Across Over 10 Incidents in August

Read about WazirX’s restructuring plan post-hack:
WazirX’s Restructuring Sparks Fresh Crypto Contagion Fears