Report: Ronin Crypto Hackers Find New Mixer To Convert Stolen ETH To BTC 
- Ronin bridge hackers moved funds to the Bitcoin network, new report shows
- The Lazarus Group has used various crypto-mingling services to hide funds, including one that has yet to be targeted by OFAC
The hacking collective believed to be behind the $625 million Ronin Bridge hack transferred stolen ether to bitcoin using a cryptocurrency mixing service that the US Treasury Department has yet to target, according to a new report.
The Lazarus Group, originally sanctioned by the Office of Foreign Assets Control (OFAC) in 2019, has used OFAC-sanctioned cryptocurrency blending services Blender.io and Tornado Cash to attempt to move and hide funds.
Hackers recently botched ChipMixer, a mixer founded in 2017 that has not yet been added to OFAC’s blocked list, according to the report by blockchain security firm SlowMist.
Lazarus Group converted 25.5 million USDC to ETH in March 2022. In the days that followed, hackers moved ETH to various exchanges, including FTX and Crypto.com before retreating to the bitcoin network and mixing it through Blender.io, as the treasury sanctioned in May.
Between April and May, the group moved funds through Tornado Cash, which was added to OFAC’s blocked list earlier this month.
Many of the funds were mixed through various services, the report states. About half of the laundered bitcoins have been run through ChipMixer, according to SlowMist.
“36.6% of laundered funds are currently held at the hacker’s address, totaling 2,586 BTC,” the report noted. “6.2% of laundered funds were moved to Blender, with 3.8% of laundered funds moved to CryptoMixer and a small percentage to other unknown entities.”
The report comes as 2022 has seen a rise in the use of crypto commingling services, which allow users to hide the transaction history of certain cryptocurrencies by pooling and mixing them with other users’ funds.
The 30-day moving average of value received by mixers hit an all-time high of nearly $52 million in crypto on April 19, according to a July report from Chainalysis — or roughly double the volumes at the same time in 2021.
Get today’s best crypto news and insights delivered to your inbox every night. Subscribe to Blockworks’ free newsletter now.
-
Casey Wagner
Blockwork
Senior reporter
