Saga funds of $6.2 million transferred to mixer after attack

SellTheBounce · 2026-01-30T23:08:00+00:00

Saga blockchain recently suffered an attack involving approximately $6.2 million. The attacker concealed the source of the funds by transferring assets in a dispersed manner and using the mixer Tornado Cash. This incident has exposed the vulnerabilities in the security of funds within the DeFi ecosystem, highlighting the need to strengthen protective measures to counter highly professionalized attack strategies.

SellTheBounce

2026-01-30 23:08:00

Abstract generation in progress

Saga blockchain recently suffered a serious attack, and the official team discovered and initiated emergency response on the 21st of this month. Approximately $6.2 million in stolen funds have officially entered the fund transfer stage, with the attacker attempting to conceal the source of the funds through a series of covert methods. According to continuous monitoring by security firm CertiK, this protocol-level attack involved multiple assets on the SagaEVM chain.

Stolen Funds Dispersed and Hidden CertiK Real-Time Tracking

Monitoring by CertiK revealed that before the stolen $6.2 million entered Tornado Cash mixers, the attacker employed a typical dispersal strategy. All stolen funds were first split and transferred into five different wallet addresses for initial concealment, a common tactic to increase the difficulty of tracking the funds. These funds then began to consolidate, preparing for the next stage of money laundering.

According to Foresight News, approximately $7 million worth of various assets on the SagaEVM chain were transferred, including USDC stablecoins, yUSD, Ethereum ETH, and cross-chain Bitcoin tBTC, among other highly liquid assets. The attacker selectively targeted tokens that are easy to liquidate and trade.

Multiple Tactics Used by the Attacker to Cover Tracks via Mixers

After the initial dispersal of funds, the attacker immediately conducted large-scale mixing operations through multiple Tornado Cash transactions. Tornado Cash, a well-known mixing protocol in the industry, uses smart contract mechanisms to completely decouple the source and destination of funds, providing technical facilitation for money laundering of illicit funds. The attacker used batch deposits to perform mixing, further reducing the risk of identification for individual transactions.

This Saga attack once again exposed the vulnerabilities in DeFi ecosystems regarding fund security. From the discovery of the attack to the transfer of funds to the Ethereum mainnet, the entire process was extremely rapid, demonstrating the attacker’s high level of professionalism. For the entire DeFi community, this incident serves as a severe warning.

SAGA-3,76%

USDC0,04%

ETH-6,75%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.