The hackers behind the $625 million Ronin sidechain hack in March transferred most of the assets to bitcoin using privacy tools. This was reported by researcher ₿liteZero from SlowMist.

I’ve been tracking down stolen coins on Ronin Bridge.
I noticed that the ronin hackers are transferring all their funds to the bitcoin network. Most of the funds are invested in mixers (ChipMixer, Blender).

This topic will show the monitoring analysis procedures. pic.twitter.com/yrazcJ22xF

— ₿liteZero (@blitezero) 20 August 2022

The attackers allegedly linked to the North Korean group Lazarus looted 173,600 ETH and 25.5 million USDC. According to the expert, almost all of the amount in Ethereum was deposited by hackers in the Tornado Cash mixing service. They only sent about 6250 ETH to Huobi, FTX and Crypto.com exchanges. ~667 ETH remained at the hackers’ addresses.

As of now, the vast majority of the Ronin hacker’s ETH funds have been deposited in Tornado Cash, and around 6,250 Ether has been deposited on exchanges (like Huobi, FTX or Cryptocom). @Ronin_Network https://t.co/J3ZSrtzRFp pic.twitter.com/CzBpYl7LWY

— ₿liteZero (@blitezero) 20 August 2022

In May, the U.S. Treasury imposed sanctions against the Blender cryptocurrency mixer. According to the agency, about $20.5 million of the amount stolen from Ronin was laundered through the service.

The expert confirmed that the hackers transferred about $20.72 million from the central exchanges to the mixer, and the amount is consistent with the amount determined by the US authorities.

According to my calculations, the amount withdrawn from the exchanges is $20.72 million. This is consistent with “over $20.5 million” in approved releases. pic.twitter.com/LBSiNCZOUb

— ₿liteZero (@blitezero) 20 August 2022

The attackers exchanged funds in Ethereum passing through Tornado Cash for a “wrapped” version of the Ren Protocol network’s bitcoin using the decentralized 1inch and Uniswap platforms.

Depositing Tornado Cash is not the end of it either.

After the hacker withdrew from Tornado Cash, he traded the funds for renBTC using 1inch or Uniswap and eventually connected them to the bitcoin network.https://t.co/yjqHEJYncs

— ₿liteZero (@blitezero) 20 August 2022

After withdrawing the assets from the protocol, the hackers sent half the amount to the ChipMixer mixer. Half of the funds that went through the service were transferred to Blender.

When I scanned bitcoin transactions (April 7 – May 14) to withdraw funds from Ronin hackers, I came to the following results:

After withdrawing from ChipMixer, half of the funds were invested in Blender. pic.twitter.com/eX12fC04GO

— ₿liteZero (@blitezero) 20 August 2022

Despite the active use of transaction privacy services by hackers, the expert hopes to trace all stolen assets. However, he acknowledges that this part of the study will be more complex than his analysis.

Remember, in August OFAC Confirmed Tornado Cash and mixer-related 39 Ethereum and 6 USDC addresses.

Read ForkLog bitcoin news in our Telegram – cryptocurrency news, courses and analysis.