Ronin hackers transferred stolen funds from ETH to BTC and used sanctioned mixers
The hackers behind the $625 million Ronin bridge assault in March have since transferred most of their funds from ETH into BTC utilizing renBTC and Bitcoin privateness instruments Blender and ChipMixer.
The hacker’s exercise has been tracked by on-chain investigator ‘₿liteZero’, who works for SlowMist and contributed to the corporate’s 2022 Mid-12 months Blockchain Safety report. They outlined the transaction pathway of the stolen funds because the Mar. 23 assault.
Nearly all of the stolen funds had been initially transformed into ETH and despatched to now sanctioned Ethereum crypto mixer Twister Money earlier than being bridged over to the Bitcoin community and transformed into BTC by way of the Ren protocol.
I have been monitoring the stolen funds on Ronin Bridge.
I’ve observed that Ronin hackers have transferred all of their funds to the bitcoin community. A lot of the funds have been deposited to mixers(ChipMixer, Blender).This thread will illustrate the monitoring evaluation procedures. pic.twitter.com/yrazcJ22xF
— ₿liteZero (@blitezero) August 20, 2022
Based on the report, the hackers, who’re believed to be North Korean cybercrime group Lazarus Group, initially transferred only a portion of the fund (6,249 ETH) to centralized exchanges together with Huobi (5,028 ETH) and FTX (1,219 ETH) on Mar. 28.
From the centralized exchanges, the 6249 ETH appeared to have been transformed into BTC. The hackers then transferred 439 BTC ($20.5 million) to Bitcoin privateness device Blender, which was additionally sanctioned by the U.S. Treasury on Could. 6. The analyst wrote:
“I’ve discovered the reply in Blender sanction addresses. Most Blender sanction addresses are Blender’s deposit addresses utilized by Ronin hackers. They’ve deposited all their withdrawal funds to Blender after withdrawing from the exchanges.”
Nevertheless the overwhelming majority of stolen funds — 175,000 ETH — was transferred Twister Money incrementally between April 4 and Could 19.
Associated: The aftermath of Axie Infinity’s $650M Ronin Bridge hack
The hackers subsequently used decentralized exchanges Uniswap and 1inch to transform round 113,000 ETH to renBTC (a wrapped model of BTC), and used Ren’s decentralized cross-chain bridge to switch the belongings from Ethereum to the Bitcoin community and unwrap the renBTC into BTC.
From there, roughly 6,631 BTC was distributed to quite a lot of centralized exchanges and decentralized protocols:
The report additionally acknowledged that the Ronin hackers withdrew 2,871 BTC (of the three,460 BTC) ($61.6 million as of Aug. 22) by way of Bitcoin privateness device ChipMixer.
₿liteZero concluded the Twitter thread by stating that the Ronin hack stays a “thriller to be investigated” and that extra progress is to be made.
