According to new findings by blockchain investigator and developer BliteZero, the attackers behind the Ronin Bridge exploit have moved the stolen crypto assets from Ethereum to the Bitcoin network. Blitezero had mentioned that he was tracking the funds and he noticed that the Ronin Bridge attackers had moved all the assets to the Bitcoin protocol using several crypto exchanges and a network bridge.
Remember that after the Ronin bridge hack, the attackers moved the stolen assets to Ethereum-based cryptocurrency mixer Tornado Cash, making it difficult for authorities to trace the movement of the stolen assets. But Tornado Cash is obviously not the end as the attackers have moved the $625 million worth of USDC and ETH to obscure the transactions.
The blockchain investigator and developer discovered that after the attackers withdrew the funds from Tornado Cash, they sent 6250 ETH to centralized exchanges like Huobi, Binance and FTX before forwarding all of it to North Korean crypto mixer, Blender. The United States Treasury department sanctioned Blender addresses in May, noting that the crypto mixer assisted the attackers to process over $20.5 million in stolen crypto assets.
Blitezero interestingly stated that the Ronin attackers used most of the sanctioned Blender addresses to receive funds after withdrawing from the centralized exchanges. Following the stolen money, Blitezero noted that the total amount withdrawn from the exchanges was $20.7 million which is very much in sync with the U.S. Treasury’s accusation.
The attackers used 1inch or Uniswap to convert the remaining assets to renBTC. renBTC is wrapped bitcoin powered by Ren protocol on the Ethereum network. The hackers were able to bridge the assets from Ethereum to the Bitcoin network since Ren enables the movement of value between blockchains. Afterwards, the hackers sent a bulk of the funds to crypto mixers like ChipMixer and Blender. They transferred the stolen funds to ChipMixer before withdrawing some on Blender.
Featured Image Source: www.thedalesreport.com
