Phemex has stolen $85 million in funds, with some flowing into Tornado Cash

On February 20th, according to Global Ledger analysis, $85 million of stolen funds from the cryptocurrency trading platform Phemex are flowing through a series of transfers, protocols, and mixing services. Hackers began to split funds into multiple new addresses and transfer them to the Tornado Cash mixer. The first batch of 2080 ETH (approximately $6 million) has been dispersed to 14 new addresses, with less than 4000 ETH remaining in the main attack wallet. The transfer method involves multiple jumps and cross chain interactions. In addition to directly transferring funds to Tornado Cash and eXch mixer for anonymization, hackers sometimes use platforms such as Wintermute, DLN Trade protocol, and THORChain to exchange assets.