Pando Rings oracle exploiter activity returned on August 18 after the wallet remained inactive for two months.
The address linked to the 2022 hack swapped 3 million DAI for about 1,570 ETH through CoW Protocol. Blockchain tracker Onchain Lens reported that roughly 800 ETH, valued near $1.52 million, then moved to Tornado Cash across eight transactions.
The renewed activity follows years of intermittent movement from funds connected to the exploit. It came three days after Pando announced that its protocol would be sunset and its DeFi products placed into maintenance mode under Mixin oversight.
Pando Rings Hack Began With Oracle Manipulation
The original attack occurred on November 5, 2022, when the exploiter manipulated the price of the sBTC-WBTC liquidity provider token on 4swap. The distorted oracle price was used in an effort to withdraw about $70 million in crypto.
Before the team intervened, around $21.9 million in ETH, EOS, and BTC had already left two Mixin wallets controlled by the attacker. Pando later worked with Mixin Network and cybersecurity company SlowMist to freeze remaining assets.
Those frozen holdings included 2,022,662 EOS, then worth about $2.36 million, alongside other tokens valued above $50 million. Pando suspended Pando Rings, 4swap, Pando Leaf, and Pando Lake while the oracle issue was addressed and said customers would be reimbursed.
Exploiter Converts DAI Into Ether
The same address has resurfaced periodically since the hack. Lookonchain reported on June 6 that the wallet used 10 million DAI to purchase 6,243 ETH at an average price of $1,602.
The tracker commented that “even the hacker is buying the $ETH dip.” This week’s transaction again converted stablecoins into Ether, but part of the ETH was subsequently transferred through Tornado Cash.
Tornado Cash remains watched because it can make transaction links harder to follow. However, mixer activity can still draw attention from blockchain investigators monitoring known exploit addresses and fund movements.
Pando Winds Down While Old Funds Move
Tornado Cash was sanctioned by the US Treasury in August 2022. It was removed from the sanctions list on March 21, 2025, after a federal appeals court ruled that immutable smart contracts could not be treated as property under sanctions law.
Pando announced on August 15 that it was discontinuing the protocol and moving its DeFi products into maintenance mode. Pando Rings now supports only loan repayments and collateral withdrawals.
Immunefi data shows oracle-related ecosystem attacks have become less common. Such incidents fell from nearly 19% of DeFi loss cases in 2022 to under 1% in 2025. The latest transactions show that funds tied to older exploits can remain inactive for years before moving again.
