- The assets taken from Ethereum have been transferred by Ronin hackers .
- Most of the stolen funds were first converted to ETH and sent to Tornado Cash.
The Ethereum assets that were taken by Ronin hackers have been moved to the Bitcoin network. The hackers who carried out the $625 million attack on the Ronin bridge in March have since converted the majority of their ETH holdings into BTC using the renBTC and Bitcoin privacy tools Blender and ChipMixer.
On-chain investigator, BliteZero has been following the hacker’s behavior. Since the March 23 incident, they described the transactions that took place with the stolen money. The majority of the stolen money was first changed into ETH and delivered to Tornado Cash, an Ethereum crypto mixer that has since been sanctioned, before being bridged to the Bitcoin network and converted into BTC via the Ren protocol.
I've been tracking the stolen funds on Ronin Bridge.
— ₿liteZero (@blitezero) August 20, 2022
I've noticed that Ronin hackers have transferred all of their funds to the bitcoin network. Most of the funds have been deposited to mixers(ChipMixer, Blender).
This thread🧵 will illustrate the tracking analysis procedures.👇🏻 pic.twitter.com/yrazcJ22xF
Utilizing Centralized Exchanges
The blockchain investigator discovered that the hackers moved around 6,249 ETH ($20.5million) to controlled exchanges (CEXs) like Binance, Huobi, and FTX after withdrawing the money from Tornado Cash and sending it to the North Korean cryptocurrency mixer Blender. The US Treasury Department imposed sanctions on Blender addresses in May after discovering that the crypto mixer helped the Ronin hackers process more than $20.5 million of the stolen money.
Using 1inch or Uniswap, the hackers changed the remaining assets to renBTC. Ren Protocol-powered renBTC is wrapped bitcoin running on the Ethereum network. The ability of Ren to transport value between blockchains allowed the hackers to connect the Ethereum assets to the Bitcoin network.
