What can I do if stolen ETH went through Tornado Cash?

Not necessarily gone — but harder. Tornado Cash uses zero-knowledge proofs, so on-chain you cannot link a deposit to its withdrawal. However, real-world recovery happens through behavioral and timing analysis:

• Deposits and withdrawals of unusual amounts (e.g. 7.4 ETH instead of the standard 10) can be correlated.
• Withdrawal addresses often interact with the same downstream exchanges within hours.
• Gas-price patterns and time-of-day clustering give probabilistic links, not certainties.

This is the kind of work that requires specialized forensics — generalist 'recovery agencies' will not get past Tornado. If you have a sizable loss (>$50k) and the deposit pre-dates OFAC sanctions enforcement, a professional demix attempt may be worth the cost. Below that, the math usually doesn't work.