A hacker involved in the $4.67 million exploit of Voltage Finance in 2022 has resurfaced, transferring approximately $182,000 worth of stolen Ether (ETH) to Tornado Cash. This move has raised concerns about the ongoing vulnerabilities in decentralized finance (DeFi) protocols and the challenges of tracking illicit transactions.
Key Takeaways
-
The hacker transferred 100 ETH, valued at $182,783, to Tornado Cash after a period of inactivity.
-
The exploit in March 2022 utilized a reentrancy attack on Voltage Finance's lending pool.
-
Voltage Finance has faced multiple security breaches, including a second exploit in March 2025.
Background of the Exploit
In March 2022, Voltage Finance fell victim to a significant exploit that drained its lending pool through a reentrancy attack. The attacker exploited a vulnerability in the ERC677 token standard, which allowed them to manipulate the protocol's callback functions. This incident resulted in the theft of various cryptocurrencies, including stablecoins like USDC and BUSD, as well as wrapped Bitcoin (WBTC).
Recent Developments
According to blockchain security firm CertiK, the hacker recently moved 100 ETH from an address linked to the original exploit to Tornado Cash, a platform known for its privacy features that obfuscate transaction trails. This transfer occurred after the address had been dormant for over five months, with the last transaction recorded 166 days prior.
Voltage Finance's Response
Following the initial exploit, Voltage Finance took several measures to mitigate the damage:
-
The hacker's address was flagged on Etherscan to prevent further transactions.
-
The protocol reached out to exchanges to block any transactions involving the stolen funds.
-
Attempts were made to negotiate a bounty with the hacker to return the stolen assets.
Despite these efforts, the hacker's recent activity indicates that the stolen funds are still being moved, complicating recovery efforts.
Subsequent Exploits
Voltage Finance faced another security breach on March 18, 2025, when its Simple Staking pools were compromised, resulting in an additional loss of $322,000. In response, Voltage Finance offered a $50,000 bounty to the attacker for the return of the funds and initiated investigations into potential insider involvement.
Broader Implications for DeFi
The resurgence of hacking incidents in the DeFi space highlights the ongoing security challenges faced by these platforms. In April alone, crypto losses surged by 1,163%, with a significant portion attributed to a single high-profile theft involving 3,520 Bitcoin. While some hackers have returned stolen funds, the overall trend indicates a growing risk for investors and users of DeFi protocols.
As the landscape of decentralized finance continues to evolve, the need for robust security measures and proactive responses to vulnerabilities remains critical. The recent actions of the Voltage Finance hacker serve as a stark reminder of the persistent threats in the crypto ecosystem.
Sources
-
Voltage Finance exploiter moves $182K in ETH to Tornado Cash, Cointelegraph.
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.