The KuCoin hacker started to mix his Ethereum through 100 ETH batches on Tornado cash. He has about $4.8 million in the wallet. So far sent about 2800 ETH to Tornado but will likely keep going until it's all in there.

Address here: https://etherscan.io/address/0x34a17418cec67b82d08cf77a987941f99dc87c6b

Ok, upon closer evaluation, this is not the first time the KuCoin hacker used Tornado cash. This is just the first time he did it from the public address and not from the side ones. Check here:

1. https://etherscan.io/address/0x443e285a20e5f1df69e9db8bca8402c176524eb6

2. https://etherscan.io/address/0x820a7a97dd146fd97f79881afdf4767624973368

3. https://etherscan.io/address/0x3781e57863f00a2ebf77a8a7e47987c46474c9c9

What the hacker did:

1. steal all ERC-20 tokens from KuCoin

2. convert the permissionless ones to ETH using Uniswap (and sometimes Kyber)

3. Disperse the ETH to multiple addresses

4. Start using Tornado cash to mix the amounts and then likely cash-out

I'd be shocked if the hacker didn't mess up and doxx himself in the process. The amount of ETH in Tornado cash is still quite small and this is likely more than 10k ETH that was sent there just from the hacker. I guess we might find out at some point

If we look at the total amount of ETH in Tornado Cash pool, the KuCoin hacker could be as much as a third of all ETH there. Maybe already withdrew something but still. This is a terrible idea