Start free
AboutMarketplacePricingContactSearch apps
Products
VantageStrataFolioGroundProof
Use cases
Treasury and financePayments and fintechTrading and market makingFunds and researchIssuers and protocolsCompliance and riskResearch and media
Sign inStart free
Dashboard · VantagePlanned

Tornado Cash Tracker: Deposits, Withdrawals and Anonymity Sets

How much flows into and out of Tornado Cash pools, and how much of it comes from addresses tied to hacks?

Deposits and withdrawals in every Tornado Cash pool, the notes still waiting, relayer use and deposits arriving from hack-linked addresses.

Build it in Studio →Ask for this data
ShareEmail itvoltfincrypto.com/apps/tornado-cash-tracker
Blueprint

What the dashboard will show.

The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.

  • Chain
  • Period

Pools

Every pool's deposits, withdrawals, balance and notes still waiting.

ETH held in pools

ETH

ETH held by all Tornado Cash ETH pools on Ethereum at the latest day's last block.

Figureprivacy_pools_dailyAwaiting data

Deposits

count

Deposit events across all pools on the selected chain over the selected period.

Figureprivacy_pools_dailyAwaiting data

Withdrawals

count

Withdrawal events across all pools on the selected chain over the selected period.

Figureprivacy_pools_dailyAwaiting data

Withdrawals through relayers

%

Share of withdrawals in the period that a relayer submitted, from the relayer field of each Withdrawal event.

Figureprivacy_pools_dailyAwaiting data

Deposits and withdrawals by week

ETH

Value deposited and withdrawn each week on the selected chain, split by pool denomination.

Stacked barsprivacy_pools_dailyAwaiting data

Pools compared

Each pool's chain, denomination, balance, notes outstanding, deposits to date and deposits and withdrawals in the period.

Tableprivacy_pools_dailyAwaiting data

Where deposits come from

Deposits from hack-linked addresses, the chains they use and the relayers that carry withdrawals.

From hack-linked addresses

USD

Value deposited in the period from addresses the incident registry ties to an exploit, valued at oracle prices at each deposit block.

Figuresecurity_incidentsAwaiting data

Active relayers

count

Relayers that submitted at least one withdrawal in the selected period.

Figureprivacy_pools_dailyAwaiting data

Deposits by chain

USD

Value deposited in the period on each covered chain with Tornado Cash pools.

Donutprivacy_pools_dailyAwaiting data

Hack-linked deposits by incident

Each incident whose attacker addresses deposited into a pool: the pools used, deposits, value and the first and last deposit.

Tablesecurity_incidentsAwaiting data

Chain
Ethereum and every other covered chain with Tornado Cash pools
Period
Last 30, 90 or 365 days
About

What it answers, and for whom.

Tornado Cash is a set of immutable contracts that break the on-chain link between a deposit and a withdrawal. Each pool takes one fixed amount, such as 1 or 10 ETH; a depositor gets a secret note, and later anyone holding it can withdraw the same amount to a new address with a zero-knowledge proof. This dashboard reads every pool's Deposit and Withdrawal events to show what goes in, what comes out and how many notes are still waiting.

The pools kept running through the 2022 sanctions and their removal in March 2025, and they remain a common hop for stolen funds. So the dashboard also counts deposits sent from addresses the incident registry ties to an exploit. It measures pools and flows in aggregate and never tries to link a withdrawal to a deposit.

Method

How it will be measured.

Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.

How receipts work →
  1. Deposits and withdrawals are decoded from each pool contract's Deposit and Withdrawal events; a pool's fixed denomination sets the amount, so counts and values are exact.
  2. Pool balances are each pool contract's ETH or token balance at the day's last block, and divided by the denomination they give the notes still waiting to be withdrawn.
  3. A withdrawal counts as relayed when its Withdrawal event names a relayer, and the relayer's fee is read from the same event.
  4. Hack-linked deposits are deposits sent from addresses the incident registry ties to an exploit, each with its incident and source; they show where stolen funds entered, not who withdrew them.

The data it needs

Chain data, with some off-chain sources

  • privacy_pools_dailyTo buildPrivacy protocolsDeposits into and withdrawals from privacy pools and shielded pools per protocol and day, and shielded supply where measurable.
  • security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
  • address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
  • native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
  • Deposit(commitment, leafIndex, timestamp) and Withdrawal(to, nullifierHash, relayer, fee) events of every Tornado Cash pool on each covered chain
  • ETH and token balances of each pool contract at the day's last block
  • Relayer registrations and stakes in the Tornado Cash relayer registry on Ethereum
  • Attacker addresses from the incident registry, each with its source (off-chain attributions)
Questions

Questions people ask.

What is Tornado Cash?

A non-custodial privacy protocol on Ethereum and several other chains. Users deposit a fixed amount into a pool and later withdraw it to any address by proving, with a zero-knowledge proof, that they hold an unspent deposit note. The core pool contracts are immutable, so no one can stop or change them.

Is Tornado Cash still sanctioned?

No. The US Treasury added the Tornado Cash contracts to its sanctions list in August 2022 and removed them in March 2025, after the Fifth Circuit ruled in Van Loon v. Department of the Treasury that immutable smart contracts are not property that can be sanctioned. Criminal cases against its developers were separate from the listing.

What is a Tornado Cash anonymity set?

The deposits a withdrawal could have come from: every earlier deposit in the same pool. A pool with many deposits hides each withdrawal better, while a pool with few gives little cover. The dashboard shows deposits to date and notes still outstanding for each pool.

How do Tornado Cash relayers work?

A relayer submits the withdrawal transaction and pays its gas, then takes a fee out of the withdrawn amount, so the receiving address needs no ETH beforehand and has no visible link to whoever funded it. Relayers register by staking TORN in the protocol's relayer registry.

Why does stolen crypto go to Tornado Cash?

Attackers deposit stolen ETH to break the trail between the theft and later withdrawals. Withdrawals cannot be matched to deposits from the contracts alone, which is why the dashboard counts hack-linked deposits at the point of entry and stops there.

Anonymity set
The deposits a withdrawal could correspond to; in a Tornado Cash pool, every earlier deposit in that pool.
Nullifier
A value published with each withdrawal that marks a note as spent without revealing which deposit it came from.
Relayer
An operator who submits withdrawals for users and is paid a fee out of the withdrawn amount.
Related
All Security and risk apps →

Build Tornado Cash Tracker: Deposits, Withdrawals and Anonymity Sets on verified data.

Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.

Start free →Open live apps