CertiK flags Tornado Cash deposits tied to wallet behind $1.58 million drain

Another wallet drain, another trip through Tornado Cash. Blockchain security firm CertiK has flagged deposits into the privacy mixer that it links to an address tied to the theft of about $1.58 million from victims. The figure has been rounded up to roughly $2 million in some coverage. Either way, the money appears to be following a well-worn path: stolen, then swiftly sent somewhere harder to follow. What CertiK found According to CertiK, the address in question recently drained about $1.58 million worth of digital assets. The firm then spotted deposits from that address into Tornado Cash. The incident lines up with a suspected private-key compromise reported around October 27, 2026. A private key is the master password to a crypto wallet. Whoever holds it controls the funds, no questions asked and no customer service line to call. That detail matters. This does not appear to be a smart contract bug or a flaw in a specific protocol’s code. CertiK’s findings point instead to a direct breach of a wallet or multisig setup. A multisig is a wallet that needs several approvals before funds can move. When those keys leak, the safeguard stops being much of a safeguard. No specific tokens ...