Ronin hackers transferred stolen funds from ETH to BTC and used sanctioned mixers

The hackers behind the $625 million Ronin bridge attack in March have since transferred most of their funds from Ether (ETH) into Bitcoin (BTC) using renBTC and Bitcoin privacy tools Blender and ChipMixer.

The hacker’s activity has been tracked by on-chain investigator ₿liteZero, who works for SlowMist and contributed to the company’s 2022 Mid-Year Blockchain Security report. They outlined the transaction pathway of the stolen funds since the March 23 attack.

The majority of the stolen funds were originally converted into ETH and sent to now sanctioned Ethereum crypto mixer Tornado Cash before being bridged over to the Bitcoin network and converted into BTC via the Ren protocol.

According to the report, the hackers, who are believed to be North Korean cybercrime organization Lazarus Group, initially transferred  just a portion of the fund, or 6,249 ETH, to centralized exchanges (CEXs) including Huobi with 5,028 ETH and FTX with 1,219 ETH on March 28.

From the CEXs, the 6249 ETH appeared to have been converted into BTC. The hackers then transferred 439 BTC, or $20.5 million at the time of writing, to the Bitcoin privacy tool Blender, which was also sanctioned by the U.S. Treasury on May 6. The analyst wrote:

“I’ve found the answer in Blender sanction addresses. Most Blender sanction addresses are Blender’s deposit addresses used by Ronin hackers. They have deposited all their withdrawal funds to Blender after withdrawing from the exchanges.”

However the overwhelming majority of stolen funds — 175,000 ETH — was transferred to Tornado Cash incrementally between April 4 and May 19.

See also  Mortgage Excess Servicing

Related: The aftermath of Axie Infinity’s $650M Ronin Bridge hack

The hackers subsequently used decentralized exchanges Uniswap and 1inch to convert around 113,000 ETH to renBTC (a wrapped version of BTC) and used Ren’s decentralized cross-chain bridge to transfer the assets from Ethereum to the Bitcoin network and unwrap the renBTC into BTC.

From there, approximately 6,631 BTC was distributed to a variety of centralized exchanges and decentralized protocols:

2f011841 8d4d 40f0 aa18 1c1543cf707f
Platforms the hackers used to transfer BTC to. Source: SlowMist.

The report also stated that the Ronin hackers withdrew 2,871 BTC of the 3,460 BTC, or $61.6 million as of Aug. 22, via Bitcoin privacy tool ChipMixer.

5724021a ef1b 4d43 8494 ea8b0b05ee38
BTC balance on platforms after the hackers withdrew funds. Source: SlowMist.

₿liteZero concluded the Twitter thread by stating that the Ronin hack remains a “mystery to be investigated” and that more progress is to be made.