Tornado Cash keeps eating ETH: UXLINK hacker dumps another 14,336 coins into the mixer 🌀

The wallet tied to September's UXLINK exploit has now sent 14,336.6 ETH through Tornado Cash over the past two weeks, according to on-chain data reviewed by GasCope. Most recently, the attacker converted millions of DAI into ETH and deposited more than $8.1 million worth of ETH into the mixing service.

The original exploit occurred in September 2025, when the hackers took over the project's multisignature wallet by exploiting a 'delegateCall' vulnerability. They minted billions of unauthorized UXLINK tokens and drained about $4.5 million in cryptocurrency assets, then moved the proceeds through multiple wallets before swapping them into DAI and ETH. After the attack, the hacker exchanged the remaining DAI for roughly 6,000.8 ETH and immediately deposited 6,038 ETH into Tornado Cash.

In a separate but concurrent flow of funds, wallets associated with the defunct Mining Express scheme have begun reallocating long-held holdings. A wallet linked to the alleged Ponzi operation converted 5,004 ETH into 8.8 million DAI, shifting toward a more liquid stablecoin position. Mining Express was founded by Kaze Fuziyama in 2019 and allegedly ran an MLM-based cryptocurrency mining scheme that drew the attention of Ukrainian authorities in 2022 after the company went bankrupt. The associated wallet received 4,512 ETH in 2024, staked the funds via Lido and Ether.fi, and fully unstaked them in May 2026.

Further movement followed the Jaredfromsubway.eth MEV bot exploit, after which about $5.1 million of an estimated $7.5 million was sent to Tornado Cash. The pattern across the UXLINK, Mining Express and Jaredfromsubway.eth incidents underscores how the same mixing endpoint continues to absorb large volumes of ETH linked to distinct exploits, with each transaction preserved on-chain in full.