Ronin hackers transferred stolen funds from ETH to BTC and used sanctioned mixers

The hackers behind the $625 million Ronin bridge attack in March have since transferred most of their funds from ETH into BTC utilizing renBTC and Bitcoin privateness instruments Blender and ChipMixer. 

The hacker’s exercise has been tracked by on-chain investigator ‘₿liteZero’, who works for SlowMist and contributed to the corporate’s 2022 Mid-Yr Blockchain Safety report. They outlined the transaction pathway of the stolen funds for the reason that Mar. 23 assault.

Nearly all of the stolen funds have been initially transformed into ETH and despatched to now sanctioned Ethereum crypto mixer Twister Money earlier than being bridged over to the Bitcoin community and transformed into BTC by way of the Ren protocol.

I have been monitoring the stolen funds on Ronin Bridge.
I’ve seen that Ronin hackers have transferred all of their funds to the bitcoin community. Many of the funds have been deposited to mixers(ChipMixer, Blender).

This thread will illustrate the monitoring evaluation procedures. pic.twitter.com/yrazcJ22xF

— ₿liteZero (@blitezero) August 20, 2022

In keeping with the report, the hackers, who’re believed to be North Korean cybercrime organization Lazarus Group, initially transferred  only a portion of the fund (6,249 ETH) to centralized exchanges together with Huobi (5,028 ETH) and FTX (1,219 ETH) on Mar. 28.

From the centralized exchanges, the 6249 ETH appeared to have been transformed into BTC. The hackers then transferred 439 BTC ($20.5 million) to Bitcoin privateness device Blender, which was additionally sanctioned by the U.S. Treasury on May. 6. The analyst wrote:

“I’ve discovered the reply in Blender sanction addresses. Most Blender sanction addresses are Blender’s deposit addresses utilized by Ronin hackers. They’ve deposited all their withdrawal funds to Blender after withdrawing from the exchanges.”

Nevertheless the overwhelming majority of stolen funds — 175,000 ETH — was transferred Tornado Cash incrementally between April 4 and Could 19.

Associated: The aftermath of Axie Infinity’s $650M Ronin Bridge hack

The hackers subsequently used decentralized exchanges Uniswap and 1inch to transform round 113,000 ETH to renBTC (a wrapped model of BTC), and used Ren’s decentralized cross-chain bridge to switch the belongings from Ethereum to the Bitcoin community and unwrap the renBTC into BTC.

From there, roughly 6,631 BTC was distributed to quite a lot of centralized exchanges and decentralized protocols:

The report additionally said that the Ronin hackers withdrew 2,871 BTC (of the three,460 BTC) ($61.6 million as of Aug. 22) by way of Bitcoin privateness device ChipMixer.

₿liteZero concluded the Twitter thread by stating that the Ronin hack stays a “thriller to be investigated” and that extra progress is to be made.