Hacker Steals $27M from Multi-Sig Wallet, Launders $19M via Tornado Cash

A complex cyberattack has resulted in the theft of $27.3 million from a multi-signature wallet. The hacker has since laundered $19.4 million using Tornado Cash and is maintaining a leveraged trading position worth almost $10 million. This event is part of a broader surge of security breaches within the cryptocurrency space that has raised alarms about safety and security risks for investors.

Key Takeaways

A sophisticated hacker drained $27.3 million from a multi-sig wallet and laundered $19.4 million through Tornado Cash.
The attacker also holds a leveraged position of nearly $10 million in cryptocurrency.
The cybercrime incident coincides with various other security breaches in the crypto industry.
Concerns over the safety of user data exploded after Ledger's recent breach, which exposed sensitive customer information, heightening risks of phishing and social engineering attacks.
Experts warn that physical threats against cryptocurrency holders are rising, potentially linked to the increase in data leaks and scams.

Major Crypto Heist and Its Consequences

A highly skilled hacker has compromised a multi-signature wallet, leading to the theft of $27.3 million. The assailant has successfully laundered $19.4 million using the privacy protocol Tornado Cash and still maintains a leveraged trading position valued at nearly $10 million.

This incident was first identified by blockchain security firm PeckShield, highlighting a worrying trend of significant cyber exploits targeting cryptocurrency holders in early 2026.

PeckShield reported that the hacker withdrew 1,000 ETH worth approximately $3.24 million from the lending platform Aave. The stolen ETH was then deposited into Tornado Cash, complementing the 6,300 ETH already funneled through the service.

The perpetrator currently possesses a leveraged long position worth $9.75 million, which consists of $20.5 million in ETH against $10.7 million in DAI.

Surge of Cyber Exploits Affects Crypto Ecosystem

The attack on the multi-sig wallet comes alongside several other security breaches reported within a short timeframe.

PeckShield traced the address 0xB8b4…3714, which has laundered 2,479.1 ETH, equivalent to $7.9 million, through Tornado Cash. This illicit activity involved funds from various TRON wallets that were bridged to the Ethereum network.

Investigations suggest the attack is connected to the “pig-butchering” investment scam, where victims are often lured through fake romantic interactions, ultimately losing their crypto assets.

In a separate incident, the hacker behind September’s UXLink breach exchanged 248 wrapped Bitcoin for 23 million DAI in under an hour, moving stolen assets accrued from minting billions of unauthorized tokens.

Simultaneously, blockchain security firm CertiK identified another $1.4 million exploit involving an unverified contract related to TMXTribe on the Arbitrum network. Attackers minted and staked the TMX LP with USDT, then swapped and unstaked various assets, enabling repeated drains of USDT, wrapped SOL, and WETH.

These incidents follow closely on the heels of a public breach at payment processor Global-e reported by hardware wallet manufacturer Ledger, which revealed that customer data had been compromised.

While Ledger confirmed that payment card details, passwords, and private keys were secure, the compromised data significantly raises the stakes for potential phishing attacks and social engineering scams.

Rising Physical Security Threats for Crypto Investors

The recent Ledger breach has amplified fears of physical attacks targeting cryptocurrency users, particularly as violent incidents soar to unprecedented levels.

Blockchain researcher Ignas noted that he was informed of his data leak, stating, “Wrench physical attacks are getting more common, and I believe that as the economy and world become more unstable, these incidents will pose serious problems for crypto users.”

Another security researcher, NanoBaiter, indicated that “threat actors are likely exploiting this data for social engineering and phishing attempts,” while analysts warn that using AI to cross-reference datasets can allow attackers to pinpoint high-value targets with high accuracy.

Investor Haseeb Qureshi’s analysis showed that violence against crypto users has grown more prevalent and severe over time. However, he also pointed out that “some of this increase is simply due to a larger population of cryptocurrency holders.”

Rezo, a Ledger user, raised concerns regarding the centralization risk in crypto infrastructure, stating, “As long as crypto products depend on centralized systems like payment processors and emails, we remain vulnerable.”

Although Ledger itself didn’t experience a direct hack, its payment processor did, leaving exposed personal information that is ideal for phishing attempts.

According to PeckShield, losses from crypto hacks fell by 60% in December 2025, amounting to $76 million, down from $194.2 million in November. Despite this decline, significant incidents continue to emerge, including a $50 million address poisoning scam and a $27.3 million key leak.

In light of these developments, security experts recommend that individuals whose information has been exposed remain vigilant against phishing attempts, consider altering their location for safety, and utilize temporary details and addresses for deliveries.