The Ronin Bridge attackers used Ren Protocol and other centralized and decentralized crypto exchanges to move the stolen funds to the Bitcoin blockchain.
The blockchain investigator and developer, ₿liteZero, noted that the Ronin Bridge hackers transferred the stolen assets to the Bitcoin blockchain.
The hackers who attacked and got away with $625 million worth of USDC and ETH used a network bridge and other centralized crypto exchanges to transfer the assets.
BliteZero, who works under SlowMist, and was part of the company’s Mid-Year Blockchain Security Report of 2022 outlined the tracking process since the attack.
Tracking the Ronin hack assets
Axie Infinity’s Ronin Bridge attack happened on 23rd March 2022 and the attackers moved the assets to a Tornado Cash mixer.
The Ethereum-based crypto mixer, Tornado Cash, makes it impossible to track the transfer of funds. However, the attackers took it a step further by obscuring the transactions.
Later in June 2022, Axie Infinity protocol went back online after the attack. The protocol announced assuring its users of safety restoration to the network.
Ronin Bridge underwent a series of audits within the platform. Several upgrades to the protocol also aided in preventing any further attacks. Major updates to the protocol included a new governance system and a new circuit breaker system.
From Ronin through CEXs
The blockchain investigator established that the attacker had initially withdrawn the stolen funds from Tornado Cash.
The attackers transferred approximately $20.7 million (6250 ETH) to several centralized exchanges such as Huobi, Binance and FTX and later sent the funds to a crypto mixer blender in North Korea.
In May 2022, the United States Treasury Department sanctioned the Blender Addresses. It was from the sanction the Treasury department realized the North Korean Lazarus group was part of the game.
The crypto mixer accommodated the processing of $20.5 million of the stolen funds.
₿liteZero also noted the hackers used the Blended Addresses to collect the funds after withdrawing from the centralized exchanges.
Assets bridged to the Bitcoin network
The investigator also noted the hackers converted approximately 113000 ETH worth of assets to renBTC using Uniswap and 1inch decentralized exchanges.
renBTC powered by the Ren protocol facilitated the movement of the stolen assets from the Ethereum blockchain to the Bitcoin blockchain.
Afterward, the hackers then transferred approximately 6631 BTC to centralized and decentralized exchanges such as ChipMixer, Blender, Coinbase and Kuna among others.
In August 2022 the hackers withdrew 2871 BTC ($61.6M) of the total 3460 BTC through the Bitcoin Privacy to ChipMixer.
Currently, ₿liteZero is working on analyzing the hacker’s activity, they believe the next steps onwards will be quite complex.
Crypto attacks on the rise
Lately, cyber crimes in the crypto space have become rampant. More crypto holders continue to lose millions of assets to attackers.
In other news, crypto holders lost their assets to an attacker who made deposits at General Bytes Bitcoin ATM machines.
Initially, the hacker modified the crypto settings of the machine using his wallet settings. He used the CAS administrative interface and created an administrative user remotely.
The attack comes in shortly after the company made public the “Help Ukraine” feature on the ATM.
In recent months attackers swindled Ronin Bridge for over $600 million. This comes as the major cybercrime in history.
The North Korean Lazarus group could also be held responsible for the Harmony Horizon Bridge attack which happened on 24th June 2022. This attack wiped off over 100 million digital assets.
Meter and Wormhole Bridges also experienced attacks leading to a loss of approximately $1 billion.
