Despite the extremely secrecy with the protocol, some have argued that there may be a way to track transactions if there is a considerable deposit and very low liquidity. By default, when users prompt the Tornado Cash pool contracts for withdrawal, the withdrawal account must have already got Ether so https://gabrielespindola.com/tornado-cash-explained-how-it-ensures-unmatched-confidentiality-on-ethereum-and-bnb/