# Tornado Cash Tracker: Deposits, Withdrawals and Anonymity Sets

> Track Tornado Cash deposits and withdrawals by pool and chain: ETH held in the pools, anonymity sets, relayer use and deposits from addresses tied to hacks.

Markdown copy of https://voltfincrypto.com/apps/tornado-cash-tracker

**Question:** How much flows into and out of Tornado Cash pools, and how much of it comes from addresses tied to hacks?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Ethereum, BNB Chain, Polygon, Arbitrum, OP Mainnet, Avalanche, Gnosis
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

Tornado Cash is a set of immutable contracts that break the on-chain link between a deposit and a withdrawal. Each pool takes one fixed amount, such as 1 or 10 ETH; a depositor gets a secret note, and later anyone holding it can withdraw the same amount to a new address with a zero-knowledge proof. This dashboard reads every pool's Deposit and Withdrawal events to show what goes in, what comes out and how many notes are still waiting.

The pools kept running through the 2022 sanctions and their removal in March 2025, and they remain a common hop for stolen funds. So the dashboard also counts deposits sent from addresses the incident registry ties to an exploit. It measures pools and flows in aggregate and never tries to link a withdrawal to a deposit.

## Blueprint

### Pools

Every pool's deposits, withdrawals, balance and notes still waiting.

- **ETH held in pools** (ETH): ETH held by all Tornado Cash ETH pools on Ethereum at the latest day's last block.
- **Deposits** (count): Deposit events across all pools on the selected chain over the selected period.
- **Withdrawals** (count): Withdrawal events across all pools on the selected chain over the selected period.
- **Withdrawals through relayers** (%): Share of withdrawals in the period that a relayer submitted, from the relayer field of each Withdrawal event.
- **Deposits and withdrawals by week** (ETH): Value deposited and withdrawn each week on the selected chain, split by pool denomination.
- **Pools compared**: Each pool's chain, denomination, balance, notes outstanding, deposits to date and deposits and withdrawals in the period.

### Where deposits come from

Deposits from hack-linked addresses, the chains they use and the relayers that carry withdrawals.

- **From hack-linked addresses** (USD): Value deposited in the period from addresses the incident registry ties to an exploit, valued at oracle prices at each deposit block.
- **Active relayers** (count): Relayers that submitted at least one withdrawal in the selected period.
- **Deposits by chain** (USD): Value deposited in the period on each covered chain with Tornado Cash pools.
- **Hack-linked deposits by incident**: Each incident whose attacker addresses deposited into a pool: the pools used, deposits, value and the first and last deposit.

Filters: Chain (Ethereum and every other covered chain with Tornado Cash pools); Period (Last 30, 90 or 365 days).

## How it will be measured

- Deposits and withdrawals are decoded from each pool contract's Deposit and Withdrawal events; a pool's fixed denomination sets the amount, so counts and values are exact.
- Pool balances are each pool contract's ETH or token balance at the day's last block, and divided by the denomination they give the notes still waiting to be withdrawn.
- A withdrawal counts as relayed when its Withdrawal event names a relayer, and the relayer's fee is read from the same event.
- Hack-linked deposits are deposits sent from addresses the incident registry ties to an exploit, each with its incident and source; they show where stolen funds entered, not who withdrew them.

## Data it needs

- `privacy_pools_daily` (to build): Deposits into and withdrawals from privacy pools and shielded pools per protocol and day, and shielded supply where measurable.
- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: Deposit(commitment, leafIndex, timestamp) and Withdrawal(to, nullifierHash, relayer, fee) events of every Tornado Cash pool on each covered chain
- Source: ETH and token balances of each pool contract at the day's last block
- Source: Relayer registrations and stakes in the Tornado Cash relayer registry on Ethereum
- Source: Attacker addresses from the incident registry, each with its source (off-chain attributions)

## Questions

### What is Tornado Cash?

A non-custodial privacy protocol on Ethereum and several other chains. Users deposit a fixed amount into a pool and later withdraw it to any address by proving, with a zero-knowledge proof, that they hold an unspent deposit note. The core pool contracts are immutable, so no one can stop or change them.

### Is Tornado Cash still sanctioned?

No. The US Treasury added the Tornado Cash contracts to its sanctions list in August 2022 and removed them in March 2025, after the Fifth Circuit ruled in Van Loon v. Department of the Treasury that immutable smart contracts are not property that can be sanctioned. Criminal cases against its developers were separate from the listing.

### What is a Tornado Cash anonymity set?

The deposits a withdrawal could have come from: every earlier deposit in the same pool. A pool with many deposits hides each withdrawal better, while a pool with few gives little cover. The dashboard shows deposits to date and notes still outstanding for each pool.

### How do Tornado Cash relayers work?

A relayer submits the withdrawal transaction and pays its gas, then takes a fee out of the withdrawn amount, so the receiving address needs no ETH beforehand and has no visible link to whoever funded it. Relayers register by staking TORN in the protocol's relayer registry.

### Why does stolen crypto go to Tornado Cash?

Attackers deposit stolen ETH to break the trail between the theft and later withdrawals. Withdrawals cannot be matched to deposits from the contracts alone, which is why the dashboard counts hack-linked deposits at the point of entry and stops there.

## Glossary

- **Anonymity set**: The deposits a withdrawal could correspond to; in a Tornado Cash pool, every earlier deposit in that pool.
- **Nullifier**: A value published with each withdrawal that marks a note as spent without revealing which deposit it came from.
- **Relayer**: An operator who submits withdrawals for users and is paid a fee out of the withdrawn amount.

## Related apps

- [Privacy Protocols Ranked by Shielded Value](https://voltfincrypto.com/apps/privacy-protocols-ranking)
- [Railgun Volume: Shielded Deposits and Withdrawals](https://voltfincrypto.com/apps/railgun-volume)
- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [OFAC Sanctioned Crypto Addresses: Balances and Activity](https://voltfincrypto.com/apps/ofac-sanctioned-crypto-addresses)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Wallet Drainer Tracker: Phishing Losses by Month](https://voltfincrypto.com/apps/wallet-drainer-tracker)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F