W of MK

Four days after the $103m Ledger wallet drain, the thief is now pushing the money through Tornado Cash again. But this time a RAILGUN clone laundering service is taking it out the other side. 🧵👇 The attacker has now changed how they withdraw from Tornado Cash. Here is how we still followed it, and what the launderer gave away about itself this time. HOW WE MATCH WHAT GOES IN WITH WHAT COMES OUT 1. The launderer pays the thief's gas. Before each run the thief moves ETH into a fresh deposit wallet. On 12 October, wallets funded by the laundering service sent gas money to all five of those deposit wallets. One got its gas at 16:58:59 UTC, 19 minutes before the thief put its 40 ETH in. The launderer had the address before the money did. 2. Its withdrawals carry a signature. Each one comes from a brand-new wallet that withdraws to itself, with no relayer, and borrows its gas in the same block from a gas-lending service, repaid out of the note. In the two weeks before, none of the 232 withdrawals from Tornado Cash's 100 ETH pool was built that way. 3. The counts line up. Six times since Monday, a batch of the thief's deposits was followed 3 to 61 minutes later by a batch of these withdrawals with exactly the same number of notes: 4, 4, 4, 4, 8 and 6. This morning the thief put a 100 ETH note in for the first time. 26 minutes later a 100 ETH note came out, with the same signature. Tornado Cash still hides which exact note paid which withdrawal. Everything either side of it is on chain. ITS OWN RAILGUN! The withdrawn ETH is sold and paid into private copies of the Railgun privacy contracts that the launderer deployed itself: the first on 27 July 2026, ten weeks before the theft, and a fresh one at 07:30 UTC today, mid-run. Their proxy contracts rebuild bit for bit from Railgun's public code with solc 0.8.17, EVM london and the optimiser set to 137 runs. Railgun's own builds use 200. Somebody typed 137. Every copy since July comes from one source tree, deployed by a script that prices its gas with Hardhat's default formula: the next base fee × 81/64. RAILGUN Clone A (USDT) - 7 Oct 2026, time unknown `0x9789477914A9572f8e14967dEE2E6A139921ED13` RAILGUN Clone B (aUSDT) - 7 Oct 2026, time unknown `0x8E894889B18Ad5DAD5EcB506dC3784BF8da84ba4` RAILGUN Clone C - 13 Oct 2026, 07:30:23 UTC `0x091F4e11C067e47EB75D72e798C906dc73F1a68a` A privacy pool with one user hides nothing. This morning's 80 ETH was sold for 202,465.808128 USDT and paid into the new copy. At 08:37:35 exactly 202,465.808128 USDT came back out, in one payment. We are working with Ledger to help identify the attacker and trace the funds.