According to PeckShield, the Penpie attacker marked the address (with a balance of 7,100 ETH) and transferred another 1,000 ETH (about $2.40 million) to the money laundering address starting with 0xD440, which in turn transferred 100 ETH to Tornado Cash.