Indexed Finance Hacker Funnels Stolen Funds Through Tornado Cash

The perpetrator who breached the DeFi project Indexed Finance in October 2021 has commenced transferring the stolen funds to Tornado Cash. This series of transactions was tracked by Cyvers Alerts.

?ALERT?@ndxfi has faced a security breach on Oct 2021!
The attacker has started funneling over $4.5M through @TornadoCash since yesterday at https://t.co/XxF1IhsbfP
Attacker still hold more than $5M digital assets at different addresses!

Want to secure your assets and prevent… https://t.co/YFs6ba83FB pic.twitter.com/vEtmw8T3tj

— ? Cyvers Alerts ? (@CyversAlerts) October 22, 2024

Experts estimate that the hacker continues to hold over $5 million in digital assets across various addresses.

On October 15, the perpetrator exploited a vulnerability in the project’s liquidity pool rebalancing mechanism. The attack affected two index tokens — DEFI5 and CC10. It was executed using flash loans.

Later, the team claimed to have identified the hacker responsible for stealing $16 million.

Previously, the Binance Labs-backed lending protocol Radiant Capital suffered an attack amounting to over $50 million. The perpetrator obtained private keys for three of the 11 signatures and altered the smart contracts.