Ronin hackers transferred stolen funds from ETH to BTC and used sanctioned mixers

CointelegraphPublished on 2022-08-22Last updated on 2022-08-22

Abstract

The hackers behind the $625 million Ronin bridge attack in March have since transferred most of their funds from ETH into BTC using renBTC and Bitcoin privacy tools Blender and ChipMixer. 

The hackers behind the $625 million Ronin bridge attack in March have since transferred most of their funds from ETH into BTC using renBTC and Bitcoin privacy tools Blender and ChipMixer. 
The hacker’s activity has been tracked by on-chain investigator ‘₿liteZero’, who works for SlowMist and contributed to the company’s 2022 Mid-Year Blockchain Security report. They outlined the transaction pathway of the stolen funds since the Mar. 23 attack.
The majority of the stolen funds were originally converted into ETH and sent to now sanctioned Ethereum crypto mixer Tornado Cash before being bridged over to the Bitcoin network and converted into BTC via the Ren protocol.
I've been tracking the stolen funds on Ronin Bridge.
I've noticed that Ronin hackers have transferred all of their funds to the bitcoin network. Most of the funds have been deposited to mixers(ChipMixer, Blender).
This thread will illustrate the tracking analysis procedures. pic.twitter.com/yrazcJ22xF
— ₿liteZero (@blitezero) August 20, 2022
According to the report, the hackers, who are believed to be North Korean cybercrime organization Lazarus Group, initially transferred  just a portion of the fund (6,249 ETH) to centralized exchanges including Huobi (5,028 ETH) and FTX (1,219 ETH) on Mar. 28.
From the centralized exchanges, the 6249 ETH appeared to have been converted into BTC. The hackers then transferred 439 BTC ($20.5 million) to Bitcoin privacy tool Blender, which was also sanctioned by the U.S. Treasury on May. 6. The analyst wrote:
“I've found the answer in Blender sanction addresses. Most Blender sanction addresses are Blender's deposit addresses used by Ronin hackers. They have deposited all their withdrawal funds to Blender after withdrawing from the exchanges.”
However the overwhelming majority of stolen funds — 175,000 ETH — was transferred Tornado Cash incrementally between April 4 and May 19.
The hackers subsequently used decentralized exchanges Uniswap and 1inch to convert around 113,000 ETH to renBTC (a wrapped version of BTC), and used Ren’s decentralized cross-chain bridge to transfer the assets from Ethereum to the Bitcoin network and unwrap the renBTC into BTC.
From there, approximately 6,631 BTC was distributed to a variety of centralized exchanges and decentralized protocols:

Platforms the hackers used to transfer BTC to. Source: SlowMist.The report also stated that the Ronin hackers withdrew 2,871 BTC (of the 3,460 BTC) ($61.6 million as of Aug. 22) via Bitcoin privacy tool ChipMixer.

BTC balance on platforms after the hackers withdrew funds. Source: SlowMist.₿liteZero concluded the Twitter thread by stating that the Ronin hack remains a “mystery to be investigated” and that more progress is to be made.

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
mantra
MantraMANTRA
xvs
VenusXVS
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
velodrome
Velodrome FinanceVELODROME
brev
BrevisBREV
zrx
ZRX（0X）ZRX
cake
PancakeSwapCAKE

Related Reads

Strategy’s STRC Drop Shows The Risk Behind Bitcoin-Linked Credit Products

Strategy Inc.'s (formerly MicroStrategy) preferred stock, STRC, traded sharply below its $100 reference value during recent market stress, hitting an intraday low of $82.53. The company's CEO framed the drop as a "leverage flush"—forced selling by investors using borrowed money—rather than a fundamental default event. This distinction highlights that the selloff resulted from market mechanics and liquidity pressures, not missed payments by the issuer. The episode underscores the specific risks embedded in Bitcoin-linked credit products, which can behave differently from holding Bitcoin or common stock. As Bitcoin treasury strategies become more complex and financialized, instruments like preferred shares introduce additional layers of risk, including leverage, liquidity constraints, and sensitivity to Bitcoin's volatility. The STRC movement serves as a warning about the fragility of these structures in stressed markets, even when the underlying company remains solvent.

bitcoinist2h ago

Strategy’s STRC Drop Shows The Risk Behind Bitcoin-Linked Credit Products

bitcoinist2h ago

Australia’s High Court Hands ASIC Major Win In Block Earner Crypto Yield Case

Australia's High Court unanimously ruled in favor of the securities regulator ASIC in a case against crypto platform Block Earner. The court determined that Block Earner's historical 'Earner' fixed-yield product was a financial product and a derivative, requiring an Australian Financial Services Licence. This landmark decision establishes that crypto yield products promising structured returns can fall under existing financial services law, regardless of their digital asset nature. While the specific product is no longer offered, the ruling sets a significant precedent for how similar crypto investment and derivative-like offerings will be regulated in Australia. The case now returns to a lower court to determine penalties against Block Earner.

bitcoinist5h ago

Australia’s High Court Hands ASIC Major Win In Block Earner Crypto Yield Case

bitcoinist5h ago

Blockchain.com Expands Tokenized Stock Access Through Ondo Finance

Blockchain.com has expanded its partnership with Ondo Finance to integrate tokenized U.S. stocks and ETFs into its wallet ecosystem. This move allows eligible, primarily non-U.S., users to access traditional financial assets through a familiar crypto-native interface, blending real-world asset exposure with existing crypto holdings like stablecoins and DeFi tools. Ondo Finance, a key player in tokenizing assets like Treasuries and equities, gains a significant distribution channel through Blockchain.com's large user base. The partnership highlights the industry trend of making tokenized assets as accessible as ordinary crypto tokens, targeting global audiences who may face barriers using traditional brokerage services. While the tokenized real-world asset (RWA) market grows increasingly competitive, questions remain around custody, regulation, and market structure. Blockchain.com and Ondo are betting that seamless wallet integration can address these challenges and drive broader adoption.

bitcoinist7h ago

Blockchain.com Expands Tokenized Stock Access Through Ondo Finance

bitcoinist7h ago

CPU Makes a Comeback to the Table, A $170 Billion "Power Seizure" Drama Begins

A new era is dawning for the server CPU (Central Processing Unit), driven by the shift from AI model training to large-scale reasoning and the rise of Agentic AI. This article explores how the CPU is reclaiming a central role in the AI data center. For years, the focus has been on the GPU (Graphics Processing Unit) for AI training. However, as AI moves to the inference and Agent phase—where tasks involve complex, multi-step reasoning, tool calls, and data management—the workload balance is flipping. Studies show CPUs now handle over 70% of the workload in Agentic AI, up from 10-30% in training. This is because Agent tasks generate massive intermediate data (KV Cache) that exceeds GPU memory, forcing it to be offloaded to the CPU's larger, more scalable memory pools. This increased importance is translating into market changes. Major players are taking note: NVIDIA launched its first standalone CPU line, Vera, based on ARM architecture and optimized for Agent performance. AMD doubled its server CPU market forecast to over $1200 billion by 2030. Analyst reports project the total server CPU market could reach $1700 billion by 2030, with AI-driven demand being a primary driver. Furthermore, the classic ratio of CPUs to GPUs in AI servers is rapidly changing, converging from 1:8 toward 1:1 for Agent deployments. This surge in demand has led to a rare industry-wide price increase of 10-15% for server CPUs from Intel and AMD, breaking a decade-long trend of "more performance for the same price." Demand is bifurcating into high-core-count CPUs for in-rack GPU support and moderate-core CPUs for standalone Agent task orchestration. In China, this global trend presents an opportunity for domestic CPU manufacturers like Hygon (海光信息) and Huawei Kunpeng, who are bolstered by both growing AI infrastructure needs and national policies promoting technological self-reliance ("xin chuang"). The maturity of their software ecosystems is also accelerating, evidenced by faster adaptation to new AI models. In conclusion, the narrative is shifting from a GPU-centric view to one where CPU-GPU synergy is critical. The CPU is no longer a peripheral component but a performance-defining bottleneck and a key growth driver in the AI hardware stack, opening a massive new market estimated in the hundreds of billions of dollars.

marsbit7h ago

CPU Makes a Comeback to the Table, A $170 Billion "Power Seizure" Drama Begins

marsbit7h ago

TechFlow Intelligence: AMD AI Director Publicly Criticizes Claude Code for "Becoming Dumber and Lazier", Trump Claims Full Ceasefire in Hormuz But Strait Still Has 80 Unexploded Mines

TechFlow Intelligence Report: This daily digest covers key developments in AI, crypto, hardware, and geopolitics. In AI, SK Telecom faces US export control scrutiny over its partnership with Anthropic, while a Gemini user reports being misled in a scam scenario, sparking safety debates. China's Z.AI launches the GLM-5.2 model, rivaling Claude Opus without NVIDIA chips. In crypto, Bithumb lists ReProtocol, and Upbit delists KernelDAO. On the hardware front, MIT researchers build a custom OS to study chips, ASML denies US claims its advanced lithography machines are in China, and Amazon considers selling its in-house AI chips. Apple's future A21 Pro chip may use TSMC's latest N2P process. Major tech issues include 10,000 GitHub repositories distributing malware and Apple patching a critical eavesdropping flaw in Beats earbuds. US stocks rise, led by semiconductors, with Intel surging 10.6%, while SpaceX falls 3.5%. Geopolitically, despite a US-Iran deal, the Strait of Hormuz remains risky with ~80 uncleared mines, stalling 80M barrels of oil on standby tankers. Iran postpones Switzerland talks, and Trump calls the agreement an "unconditional surrender." The report highlights a contrast: temporary geopolitical calm versus the ongoing, fundamental restructuring of tech supply chains and chip independence.

marsbit7h ago

TechFlow Intelligence: AMD AI Director Publicly Criticizes Claude Code for "Becoming Dumber and Lazier", Trump Claims Full Ceasefire in Hormuz But Strait Still Has 80 Unexploded Mines

marsbit7h ago

Trading

Spot
Futures

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of ETH (ETH) are presented below.

活动图片

Top Questions