The suspect behind the $6 million decentralized bank financing agreement LendHub has just transferred more than half of his illegal gains so far in January to the approved login password mixer Tornado Cash.

Blockchain security companies PeckShield and Beosin warned their followers to watch out for money movements on Feb. 27, emphasizing that about 2415 Ether (ETH), worth about $3.85 million, were sent to Tornado Cash from a wallet associated with the January 12 attack.

PeckShield previously reported that the LendHub exploit was the biggest in January, stealing $6 million from the contract.

Beosin, an intelligence and information company on the chain, said on Twitter that the latest move represents that exploiters have sent 3515.4ETH to Tornado Cash since January 13, with a value of more than $5.7 million at this stage.

Tornado Cash is a login password mixing service that attempts to buy and sell under the secret name of etherFong according to the composition of a large number of etherland before depositing funds in another detailed address.

On Aug. 8, the offices of property manipulation companies of other foreign countries (OFAC) imposed sanctions on the service, mainly because it made profits on suspicion of money laundering.

Despite the sanctions and the shutdown of the service, Tornado Cash can still run and apply because it is a smart contract built on blockchain technology blockchain.

Cyber hackers and fraudsters previously contributed about 34 per cent of the total money injected into the mixer, sometimes about $25 million a day, but that number fell 68 per cent within 30 days of sanctions, according to a January report by Chainanalysis, a blockchain analytics company.

The villains in this space participate in this service frequently again. Most recently, on February 20th, the exploiters behind a new Defi project based on hedging arbitrage transferred more than $1.86 million in illegal data encryption to Tornado Cash.

The notorious North Korean hacker alliance Lazarus Group often pushes billions of dollars to mixers such as Tornado Cash and Sinbadd.

A Chainanalysis report in early February said that funds used by North Korean cyber hackers were "transferred to the mixer at a much faster rate than funds stolen by other organizations or teams."