Thousands of Ether From Ronin Exploit Moved to Tornado Cash, Data Show

More than 2,001 ether were moved Monday from addresses connected to the $625 million exploit, with about 70% passing to the privacy tool in the early hours, on-chain data show.

Apr 4, 2022 at 9:25 a.m. UTC
Updated Apr 4, 2022 at 2:35 p.m. UTC

Shaurya is an analyst/editor for CoinDesk's markets team in Asia.

The exploiter behind Ronin’s unprecedented $625 million bridge attack from last week apparently moved some 1,400 ether (ETH) to privacy tool Tornado Cash on Monday morning during Asia hours, and then the remaining 600 ETH during European hours, on-chain data connected to the exploit’s addresses show.

  • The main Ethereum address associated with the exploit sent more than 2,001 ETH in two transactions to a different address – labeled “Ronin Bridge Exploiter 8” on the tracking tool Etherscan – in early Asian hours, the data shows.
  • Some 1,400 ETH were then sent to Tornado Cash over 14 transactions, the data shows. The moved ether was valued at over $4.9 million at writing time. The remaining 600 ether, valued at $2 million, was moved to Tornado Cash in European hours, the data show.
  • The main wallet that holds stolen funds still has in excess of 173,000 ETH, valued at over $607 million, at writing time.
  • Tornado enhances the privacy of transactions by breaking the on-chain link between a source and a destination address. This allows exploiters and hackers to mask their addresses while withdrawing illicitly gained funds.
  • Several thousands of ether had previously been moved to other wallets, data apparently shows. Those transactions ranged from 1 ETH to over 10 ETH.
  • Ronin Network was hit by a $625 million exploit last week that affected Ronin validator nodes for Sky Mavis, the publisher of the popular Axie Infinity game, and the Axie DAO.
  • The attacker “used hacked private keys in order to forge fake withdrawals” from the Ronin bridge across two transactions, as seen on Etherscan, Ronin said in a blog post on Substack.
  • Investigations are underway, with all former Sky Mavis validators said to have been replaced.

UPDATE (April 4, 13:16 UTC): Updates story to reflect additional movement of ether out of Ronin Bridge Exploiter 8 address during European hours.

The Festival for the Decentralized World
Thursday - Sunday, June 9-12, 2022
Austin, Texas
Save a Seat Now

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

CoinDesk - Unknown

Shaurya is an analyst/editor for CoinDesk's markets team in Asia.

CoinDesk - Unknown

Shaurya is an analyst/editor for CoinDesk's markets team in Asia.

Trending

1
CoinDesk - Unknown
First Mover Asia: Bitcoin Dominates but Altcoins Lurk

Although Terra's collapse has raised existential questions about the future of DeFi, some traders appear to be preparing for a return to altcoins; BTC remains rangebound below $30,000 in Tuesday trading.

Although Terra's collapse has raised existential questions about the future of DeFi, some traders appear to be preparing for a return to altcoins; BTC remains rangebound below $30,000 in Tuesday trading.

CoinDesk - Unknown
2
CoinDesk - Unknown
NEAR Protocol

CoinDesk - Unknown
3
CoinDesk - Unknown
MOBOX

CoinDesk - Unknown
4
CoinDesk - Unknown
Moonriver

CoinDesk - Unknown