Lick Implicated in $90M Theft: On-Chain Tracking Reveals Tornado Cash Connection

Security researchers have uncovered a significant criminal operation allegedly involving an individual known as Lick, who stands accused of orchestrating the theft of over $90 million from a U.S. government-controlled cryptocurrency address. The scheme also included targeted thefts against multiple undisclosed victims during late 2025. Blockchain analysis has tracked suspicious fund movements, exposing how stolen assets were funneled into privacy-focused mixing services.

The Scale of the Scheme: How Lick Connected to Multi-Million Dollar Misappropriation

According to findings reported by PANews, Lick is the central figure in what appears to be one of the more substantial cryptocurrency theft cases on record. The initial breach involved unauthorized access to a government-seized address containing significant holdings. Beyond this primary heist, the perpetrator targeted additional victims across a two-month window spanning November through December 2025, suggesting a coordinated and ongoing criminal operation rather than isolated incidents.

The targeting of multiple victims alongside a major government-held address points to sophisticated technical knowledge and access to advanced hacking capabilities. This multi-pronged approach raises concerns about how such breaches could occur despite enhanced security measures.

Tracking the Trail: Tornado Cash Deposits and Fund Obfuscation

On-chain monitoring systems detected that Lick began systematically moving stolen funds into Tornado Cash, a service designed to obscure cryptocurrency transaction trails through mixing protocols. So far, approximately 11,037 ETH—valued at millions of dollars depending on current market rates—has been transferred to the mixer. This substantial volume indicates a deliberate effort to launder the stolen assets and complicate recovery or attribution efforts.

The choice of Tornado Cash as a vehicle for fund concealment is particularly notable, as the platform has become synonymous with both legitimate privacy concerns and illicit money laundering activities. The scale of deposits reveals how criminal actors leverage such services to evade blockchain surveillance.

Cryptocurrency Mixing Risks: Why On-Chain Monitoring Matters

This case underscores the ongoing cat-and-mouse game between law enforcement, security researchers, and bad actors in the crypto ecosystem. While privacy tools serve legitimate purposes, their exploitation by criminals highlights the importance of advanced monitoring infrastructure. The fact that Lick’s activities could be traced despite mixing attempts demonstrates that on-chain analysis remains a powerful deterrent and investigative tool.

The incident also reinforces why institutional security protocols around government-held crypto assets require constant evolution. As theft methods become more sophisticated, so too must the defensive measures protecting high-value targets.