Ronin hackers transferred stolen funds through banned crypto mixers

The attackers performed a series of digital asset conversions to confuse the trail

22.08.2022 - 08:15

645

2 min

What’s new? Hackers transferred all of the stolen funds from the Ronin Network sidechain to the Bitcoin network, and most of the coins were subsequently transferred to cryptocurrency mixers ChipMixer and Blender. This was reported by a researcher and developer of the crypto-tracking platform MistTrack under the pseudonym BliteZero on his Twitter account on August 20. As a result of the March 29 hack of Ronin, attackers withdrew more than $625 million in digital assets.

I've been tracking the stolen funds on Ronin Bridge.I've noticed that Ronin hackers have transferred all of their funds to the bitcoin network. Most of the funds have been deposited to mixers(ChipMixer, Blender).This thread🧵 will illustrate the tracking analysis procedures.👇🏻 pic.twitter.com/yrazcJ22xF— ₿liteZero (@blitezero) August 20, 2022

How did events develop? The FBI linked the attack on the sidechain to the hacker group Lazarus from the DPRK. The US Treasury Department put the wallet that held some of the funds from the hack on the sanctions list.

According to BliteZero, the hackers behind the Ronin attack converted most of the stolen funds into ETH and sent them to Tornado Cash, a crypto mixer that was sanctioned by the US authorities on August 8. The attackers then converted them to BTC using the renBTC protocol and sent them to ChipMixer and Blender. The latter was put on the US sanctions list back in May.

According to a SlowMist report, a total of 74,7% of the total amount of criminal funds on the Ethereum network were laundered through Tornado Cash. Of the remaining funds, about 24% are still in hackers’ wallets and 1,5% were sent to exchanges. The research also found that Tornado Cash accounted for the largest part of the initial funding of money laundering incidents on the Ethereum and Bitcoin networks.

Author: