Despite the ultra secrecy of your protocol, some have argued that there might be a means to track transactions when there is a substantial deposit and low liquidity. By default, when users prompt the Tornado Cash pool contracts for withdrawal, the withdrawal account has to have already got Ether so https://npx555.com/how-tornado-cash-enhances-privacy-for-ethereum-and-bnb-transactions/