Iris
News

Exploit

Initia exploit: 1,135.5 ETH traced to Tornado Cash, THORChain and NEAR Intents

1,135.5 ETH traced

$2.6M bridged out of Initia on Oct 23 was swapped to 1,135.52 ETH, parked four days, then emptied: 920 ETH into Tornado Cash, the rest through THORChain and NEAR Intents.

InitiaEthereumFunds moving
Open the live board

Key facts

Amount
1.4M AUSD, 1.08M USDC and 105 ETH bridged out (about $2.6M), swapped to 1,135.52 ETH
Victims
Initia
Date
Oct 23, 2026
Where the funds are
At 16:54 UTC Oct 28: 920 ETH in Tornado Cash (11 deposits), about 100.6 ETH swapped to ZEC and 59 ETH to DAI on THORChain, 30 ETH at an unidentified deposit service, 23.35 ETH sent to NEAR Intents, of which 13.13 ETH was still pending at two deposit addresses.
Freezable
Possibly 13.13 ETH still pending at two NEAR Intents deposit addresses (0x250e23ad74f2c43630feeecc928392d6e2b80fdd, 6.48 ETH; 0x3e889dbdb0303810781a04e8a10ad263ee9b2d4a, 6.64 ETH) as of 16:54 UTC Oct 28. The rest is in Tornado Cash or already swapped.
Addresses
  • 0xdd922c841d85e12dac2dc2eef5a5e29cfff6edfaEthereum, attacker, received the bridged funds; gas from Tornado Cash
  • 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8Ethereum, consolidation wallet, parked 4 days
  • 0xa764b87fcb14bc850b68dfe41720cba3b24a89c0Ethereum, fresh wallet, 400 ETH on Oct 27
  • 0x6b1175612794568d56d72afaa098402afc0299a4Ethereum, fresh wallet, 735.5 ETH on Oct 28
  • 0xdb3055a681a860955a6a49617062e7653f14966aEthereum, fresh wallet
  • 0x3c58043e2cdda4e3a0372e776bb464b40548b402Ethereum, hop wallet
  • 0x8d9658e9d61457d253a072f9eaf17b86d8a307b3Ethereum, hub, THORChain to ZEC through 42 one-time wallets

Updates

  1. Consolidation wallet empty. 920 ETH in Tornado Cash; 13.13 ETH still pending at two NEAR Intents deposit addresses.

What happened

On Oct 23, 2026, an attacker took about $2.6M out of Initia. Iris read the Ethereum side of the money on chain.

The attacker bridged out 1.4M AUSD (LayerZero), 1.08M USDC (Noble, Circle CCTP) and 105 ETH (Initia Bridge), all into one Ethereum address, 0xdd922c841d85e12dac2dc2eef5a5e29cfff6edfa. Within minutes it was swapped to ETH on 1inch and 0x: 1,135.52 ETH. The wallet's gas came from Tornado Cash that morning.

Parked four days

All 1,135.5 ETH went in one transfer to a consolidation wallet, 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8, and sat there for four days.

Emptied Oct 27 and 28

Two fresh wallets emptied it: 400 ETH on Oct 27 (0xa764...89c0) and 735.5 ETH on Oct 28 (0x6b11...99a4). From there the money split five ways:

  • Tornado Cash: 920 ETH in 11 deposits (9 x 100 ETH and 2 x 10 ETH).
  • THORChain to Zcash: about 100.6 ETH, through a hub wallet (0x8d96...07b3) that split it into 42 one-time wallets.
  • THORChain to DAI: 59 ETH, through a one-time wallet.
  • An unidentified deposit service: 30 ETH.
  • NEAR Intents: 23.35 ETH across three deposit addresses. One deposit (10.2 ETH) was swapped to ZEC. Two, 6.48 ETH and 6.64 ETH, were still pending at 16:54 UTC Oct 28.

110 ETH of the NEAR Intents and THORChain legs passed through 0xf374...407b. That address has been active since Oct 3, before the hack, so it may be a service rather than the attacker.

Where it stands

Most of the money is now in Tornado Cash or swapped to ZEC and DAI on THORChain. The only funds Iris saw still in flight were the 13.13 ETH pending at two NEAR Intents deposit addresses at 16:54 UTC Oct 28:

  • 0x250e23ad74f2c43630feeecc928392d6e2b80fdd: 6.48 ETH
  • 0x3e889dbdb0303810781a04e8a10ad263ee9b2d4a: 6.64 ETH

Amounts and times were read on chain. USD values use the attacker's own swap rate on Oct 23.

Full board: /explorer/initiaex-ploittrace28

Every investigation