Regardless of the ultra secrecy on the protocol, some have argued that there may be a means to track transactions if there is a big deposit and lower liquidity. By default, when buyers prompt the Tornado Cash pool contracts for withdrawal, the withdrawal account has to already have Ether so https://ultragripper.info/tornado-cash-explained-how-it-ensures-unmatched-confidentiality-on-ethereum-and-bnb/