Mixer withdrawal → protocol interaction

Methodology how we score #

What this measures
This real-time signal fires when a wallet that has recently withdrawn from Tornado Cash, Railgun, or a comparable privacy mixer interacts with the monitored protocol. The signal is generated by cross-referencing the mempool and on-chain transaction history against a continuously updated mixer-cluster feed: any protocol interaction from a mixer-funded address within a configurable recency window (default 72 hours) triggers the alert. Category 6 context: this is a precursor signal — it fires before an exploit materializes, providing an early warning window for depositors to assess elevated risk.

Why it matters
Across the dataset, attacker addresses in the majority of on-chain exploits were funded via Tornado Cash or equivalent mixers shortly before the attack. Infini ($49.5M, 2025) shows the pattern most cleanly: 1 ETH Tornado Cash to a new wallet immediately before the rogue dev address executed the drain. KyberSwap Elastic ($48M, 2023) and BonqDAO ($120M) both show Tornado Cash or FixedFloat funding of attacker addresses in the pre-attack window. The signal does not distinguish legitimate privacy users from attackers — it is a rate-of-alert mechanism — but the combination of mixer funding and subsequent protocol interaction elevates the probability of malicious intent.

Green / Yellow / Red
Green is the baseline state when no mixer-funded address has interacted with the protocol in the trailing 72 hours. Yellow fires when one or more mixer-funded addresses have interacted with the protocol but transaction patterns are consistent with normal DEX or lending use. Red fires when a mixer-funded address interacts with the protocol in a pattern consistent with known pre-strike behavior — unusually large positions, repeated small transactions probing contract state, or governance proposal creation.

Common gray cases
Gray applies when the mixer-cluster feed is more than 24 hours stale or when the protocol operates on a chain where mempool monitoring coverage is incomplete.

Notable historical examples
- Kelp DAO (rsETH) ($292M, 2026): Six attacker wallets funded via Tornado Cash approximately 10 hours before exploit.
- Euler Finance ($197M, 2023): Associated attacker address had prior BSC exploit proceeds deposited to Tornado Cash.
- BonqDAO ($120M, 2023): Attacker funded via Tornado Cash before attack.
- Infini ($49.5M, 2025): 1 ETH Tornado Cash to new wallet immediately before attack execution.
- KyberSwap Elastic ($48M, 2023): Tornado Cash and FixedFloat funding across chains prior to six-chain simultaneous exploit.

Measurement what to look for #

Detect whether a wallet that recently withdrew from Tornado Cash, Railgun, or similar mixer has interacted with this protocol.

Data & output #

Scored protocols 0 carry this factor #

Linked hacks 38 historical incidents #