When a sophisticated attacker compromised 1inch’s Limited Resolver smart contract in December 2024, they followed a well-worn path: convert stolen assets to ETH, deposit into Tornado Cash, and disappear into the mixer’s anonymity set. For most investigators, that’s where the trail goes cold, but for us, that’s where the work begins.
The Attack
On December 9, 2024, an attacker gained unauthorized access to a private key controlling 1inch Labs’ Limited Resolver smart contract. The breach was methodical: the attacker deployed malicious contracts on Ethereum before expanding operations across multiple chains, systematically draining assets including USDT, USDC, BNB, ETH, MATIC, and POL from BSC, Base, Polygon, Ethereum, Optimism, and Arbitrum networks.
The stolen funds, totaling $2.2 million, were funneled through an Ethereum address and deposited into Tornado Cash in fixed denominations (1 ETH, 10 ETH, and 100 ETH pools), with approximately 545 ETH entering the mixer.
The Challenge: Finding Signal in the Noise
Tornado Cash functions as a non-custodial privacy protocol that breaks the on-chain link between deposits and withdrawals. When funds enter, they join an anonymity set with thousands of other deposits. When they exit, the connection to the original source is cryptographically obscured.
Standard blockchain analytics tools can identify what goes into Tornado Cash, but determining which withdrawals correspond to specific deposits requires a fundamentally different investigative approach – particularly when analyzing months of withdrawal activity across multiple pools.
The Recoveris Methodology
Our team analyzed 6,231 withdrawals from Tornado Cash’s pools spanning from the initial deposit date through May 2025. Standard analytical approaches failed to identify valid candidates.
The breakthrough required advanced behavioral profiling methodologies beyond conventional blockchain analytics. By systematically analyzing operational patterns across the entire withdrawal dataset, we identified a singular behavioral fingerprint occurring across a specific amount of ETH, matching the stolen amount and revealing the perpetrator’s post-mixer strategy across multiple chains. This analysis provided actionable intelligence connecting the withdrawn funds to identifiable consolidation points and endpoints.
The Results
This analysis revealed a singular pattern occurring across a specific amount of ETH in withdrawals, remarkably close to the stolen amount. The identified behavioral chain showed consistent post-withdrawal activity across multiple blockchains, ultimately consolidating at addresses with distinct operational characteristics. The funds moved through cross-chain infrastructure before converging at endpoints that included identifiable service providers, providing actionable intelligence for potential enforcement coordination.
No other withdrawal pattern in the six-month dataset matched this behavioral profile for a comparable ETH amount, providing high-confidence attribution of the perpetrator’s exit strategy from Tornado Cash.
Why This Matters
This case demonstrates a fundamental shift in blockchain forensics. As mixers and privacy protocols become standard components of sophisticated laundering operations, the industry needs investigative methodologies that extend beyond conventional address clustering and heuristic analysis.
The 1inch case required analyzing over 6,000 transactions to identify 553 ETH in related withdrawals – a 10:1 signal-to-noise challenge that standard tools cannot address at scale. Success depended on detecting behavioral fingerprints across multiple chains that remained visible even after funds passed through Tornado Cash’s anonymity set.
For legal professionals, compliance teams, and institutions managing crypto security incidents, this case underscores why specialized forensic intelligence becomes essential when standard tracing reaches its limitations. The ability to follow funds through sophisticated obfuscation techniques, and provide court-admissible documentation of those findings increasingly determines whether stolen assets can be identified, frozen, and recovered.
1inch coverage: 1inch security incident response
