Cork Protocol Exploiter Resurfaces, Launders $11M and Donates to Tornado Cash Defense Fund
The attacker behind the $12 million exploit of Cork Protocol in May has resurfaced, sparking fresh concerns over fund recovery efforts as they launder millions through Tornado Cash and make a surprising public donation.
The attacker behind the $12 million exploit of Cork Protocol in May has resurfaced, sparking fresh concerns over fund recovery efforts as they launder millions through Tornado Cash and make a surprising public donation.
On Wednesday, June 25, blockchain security firm PeckShield Alert flagged renewed activity from wallet addresses linked to the Cork Protocol hack. These movements mark the first since the May 28 attack , which saw the decentralized finance (DeFi) platform drained of approximately 3,761 wrapped staked ETH (wstETH).
#PeckShieldAlert #CorkProtocol Exploiter 2 – labeled address has transferred a total of 4,520 $ETH (worth ~$11M) to #TornadoCash & donated 10 $ETH to #Juicebox : Free Alexey & Roman (Tornado Cash developers’ legal fund) https://t.co/ITTET3M1Ak
— PeckShieldAlert (@PeckShieldAlert) June 25, 2025
According to PeckShield, the exploiter began by transferring 1,410 ETH — worth roughly $3.2 million — to Tornado Cash, a privacy-focused crypto mixer often used to obscure the origins of stolen assets. This was followed by an additional 3,110 ETH transfer, bringing the total laundered to 4,520 ETH, or around $11 million at current market rates.
In a surprising turn, the attacker also sent a 10 ETH donation to a Juicebox crowdfunding campaign supporting the legal defense of Tornado Cash developers, Alexey Pertsev and Roman Storm. Both developers are currently facing legal action over the platform’s use by cybercriminals and sanctioned entities.
While the motive behind the donation remains unclear, it has added a new layer of complexity to Cork Protocol’s ongoing recovery efforts. Earlier this month, the protocol stated that it remains committed to asset recovery and is collaborating with security partners. However, the recent laundering through Tornado Cash could further complicate the tracking and retrieval of stolen funds.
The original breach targeted Cork’s wstETH:weETH market, exploiting two sophisticated flaws in the protocol’s code. The attacker reportedly deployed a malicious hook to bypass validation checks and quickly moved the assets through the 1inch exchange aggregator, effectively obfuscating their trail.
As investigations continue, Cork Protocol has promised to strengthen its defenses to prevent similar exploits in the future.
If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter , LinkedIn , Facebook , Instagram , and CoinMarketCap Community.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
$8.8 billion outflow countdown: MSTR is becoming the abandoned child of global index funds
The final result will be revealed on January 15, 2026, and the market has already started to vote with its feet.
Deconstructing DAT: Beyond mNAV, How to Identify "Real vs. Fake HODLing"?
There is only one iron rule for investing in DAT: ignore premium bubbles and only invest in those with a genuine flywheel of continuously increasing "crypto per share."
Empowered by AI Avatars, How Does TwinX Create Immersive Interaction and a Value Closed Loop?
1. **Challenges in the Creator Economy**: Web2 content platforms suffer from issues such as opaque algorithms, non-transparent distribution, unclear commission rates, and high costs for fan migration, making it difficult for creators to control their own data and earnings. 2. **Integration of AI and Web3**: The development of AI technology, especially AI Avatar technology, combined with Web3's exploration of the creator economy, offers new solutions aimed at breaking the control of centralized platforms and reconstructing content production and value distribution. 3. **Positioning of the TwinX Platform**: TwinX is an AI-driven Web3 short video social platform that aims to reconstruct content, interaction, and value distribution through AI avatars, immersive interactions, and a decentralized value system, enabling creators to own their data and income. 4. **Core Features of TwinX**: These include AI avatar technology, which allows creators to generate a learnable, configurable, and sustainably operable "second persona", as well as a closed-loop commercialization pathway that integrates content creation, interaction, and monetization. 5. **Web3 Characteristics**: TwinX embodies the assetization and co-governance features of Web3. It utilizes blockchain to confirm and record interactive behaviors, turning user activities into traceable assets, and enables participants to engage in platform governance through tokens, thus integrating the creator economy with community governance.
Aster CEO explains in detail the vision of Aster privacy L1 chain, reshaping the decentralized trading experience
Aster is set to launch a privacy-focused Layer 1 (L1) public chain, along with detailed plans for token empowerment, global market expansion, and liquidity strategies.
Trending news
MoreCrypto prices
More
