₿liteZero states, "I've been tracking the stolen funds on Ronin Bridge. I've noticed that Ronin hackers have transferred all of their funds to the bitcoin network."
The perpetrators behind one of the largest crypto hacks allegedly used Tornado Cash as one of the several means to conceal the transactions and transfer the $625M worth of USDC and Ethereum tokens to the Bitcoin network.
Earlier this year, Axie Infinity was targeted by a security breach wherein the perpetrators managed to compromise and take over five validator nodes. For context, one needs access to at least five out of the nine validator nodes to initiate transactions on the Ronin Network.
As a result, the hackers were able to drain 173.6K ETH and 25.5M USDC from the Ronin Network, resulting in a loss of over $650M from the hack.
Following the attack, the Ronin bridge was closed for a few months and restarted after a hard fork. Additionally, the number of validators to approve withdrawals was increased to eight.
Almost five months later, crypto developer and investigator ₿liteZero revealed tracking the hackers' movements. They claim that the perpetrators, now identified as Lazarus, first sent 6.25K ETH to crypto exchanges FTX, Crypto.com, and Houbi on March 28 and withdrew BTC to Blender.io by March 29. Additionally, between April 4 and May 19, Lazarus had successfully transferred 175K Ethereum to Tornado Cash.
₿liteZero posts a timeline of the events and states that the hackers then used decentralized exchanges 1Inch and/or Uniswap to swap the funds deposited to Tornado Cash for renBTC. Subsequently, they sent most of these funds to mixers such as ChipMixer and Wasabi CanJoin to further hide their transactions. Lastly, ₿liteZero revealed a small portion went to crypto exchanges Binance, Coinbase, and WhiteBit, and that the hackers have successfully withdrawn at least $20.72M of the stolen assets from exchanges.
