Bitrue Hacker’s Desperate Move: $16M Laundered Via Tornado Cash

News from the world of on-chain investigation reveals a significant development regarding the **Bitrue hacker**. It appears the individual responsible for the April 2023 exploit, which resulted in a $23 million crypto loss for the Bitrue exchange, is actively engaged in **crypto laundering** using the controversial mixer service, **Tornado Cash**. This activity highlights the ongoing challenge of tracking illicit funds in the digital asset space.

Tracing the Funds: What Did On-Chain Analysis Uncover?

Thanks to diligent **on-chain analysis**, specifically by analyst @EmberCN, the hacker’s recent financial maneuvers have come to light. The trail shows a distinct pattern aimed at obscuring the origin of the stolen assets.

• **The ETH Sale:** In March 2024, the **Bitrue hacker** reportedly sold a substantial amount of Ethereum (ETH) – precisely 4,207 ETH.
• **Acquiring DAI:** This ETH sale, executed at an average price of $3,885 per ETH, allowed the hacker to acquire approximately $16.34 million worth of DAI stablecoin.
• **The Laundering Phase:** The critical step in the process involves using this 16.34 million DAI. The hacker is now using this DAI to purchase ETH again, and then feeding that ETH into **Tornado Cash** for **ETH laundering**.

This sequence of swapping assets (ETH to DAI, then DAI back to ETH) before using a mixer is a common tactic employed by those attempting to break the direct link between stolen funds and their eventual destination. The **on-chain analysis** provides a clear, albeit complex, picture of these movements.

Why Use Tornado Cash for Crypto Laundering?

**Tornado Cash** gained notoriety as a decentralized protocol designed to improve transaction privacy on Ethereum. By pooling and mixing ETH and other ERC-20 tokens from multiple users, it makes it difficult to trace the flow of funds from source to destination. While it has legitimate privacy use cases, its fungibility-enhancing features have made it a popular tool for **crypto laundering** by hackers and other illicit actors.

The hacker’s choice of **Tornado Cash** for this large sum of ETH (acquired via the DAI swap) underscores their intent to make the funds untraceable after they exit the mixer protocol. This specific form of **ETH laundering** through a mixer is a significant challenge for law enforcement and investigators trying to follow stolen assets.

What Does This Mean for Crypto Security and Traceability?

The actions of the **Bitrue hacker** serve as a stark reminder of several key points:

• **Persistence of Threat Actors:** Hackers often hold onto stolen funds for periods before attempting to move or cash them out, waiting for opportunities or perceived lulls in surveillance.
• **The Role of On-Chain Analysis:** Tools and analysts capable of performing detailed **on-chain analysis** are crucial in monitoring suspicious movements, even months or years after an exploit occurs.
• **Challenges of Mixers:** Protocols like **Tornado Cash**, despite sanctions and efforts to curb their misuse, remain functional and pose a significant obstacle to tracing illicit funds once they enter the mixing pool. The process of **ETH laundering** via mixers complicates attribution.
• **Industry Responsibility:** Exchanges and platforms must continue to enhance security measures to prevent breaches and improve their capabilities for monitoring and potentially freezing suspicious outgoing transactions linked to past exploits.

While tracing funds post-mixer is incredibly difficult, the initial steps leading up to the mixer – like the ETH to DAI swap identified by **on-chain analysis** – often leave detectable footprints. This allows analysts to confirm that funds linked to a specific exploit are being moved and laundered, even if the final destination remains hidden.

A Continuous Battle

The situation with the **Bitrue hacker** and their use of **Tornado Cash** for **crypto laundering** is a clear example of the ongoing cat-and-mouse game in the crypto security world. As exchanges and investigators improve their tracking methods through advanced **on-chain analysis**, malicious actors adapt their techniques, employing mixers and complex transaction patterns like the ETH-DAI swap followed by **ETH laundering**. Staying ahead requires constant vigilance, improved security protocols, and sophisticated analytical tools to protect the ecosystem and identify illicit financial activity.