In a sophisticated money laundering operation, the perpetrators behind the recent WazirX hack of Rs 2000 crore, are actively converting their stolen cryptocurrencies into Bitcoin, through multiple privacy-enhancing services, with a significant portion being transformed, according to the leading digital forensics firm Crystal Intelligence.
According to a report by Crystal Intelligence, the hackers are using Tornado Cash, a decentralized privacy protocol, as their initial laundering vehicle. The volume of transactions processed through Tornado Cash’s pools—each valued at approximately $265,000—was unusually high, which attracted attention to their activities.
According to the investigation findings, on September 10, 2024 a massive 98% of all incoming funds to Tornado Cash were linked with the WazirX attackers.
Following their Tornado Cash exits, the criminals have established distinct patterns for moving the funds. The investigation disclosed three primary methods, the first one was direct transfers of 99.5 ETH to THORChain via intermediate addresses, the second one was complex routes involving multiple hops before reaching THORChain, and the last one was, immediate splits across different addresses before THORChain deposits.
The attackers choose THORChain, a decentralized cross-chain liquidity protocol, to convert their stolen funds into Bitcoin. Moreover, the investigation has found hundreds of stolen Bitcoins sitting in various digital addresses. Additionally, a substantial portion continues to move through Wasabi wallet and some privacy-enhancing services.
To make the investigation process more complex attackers cycle back the funds to tornado cash and convert it back into Ethereum. However, Law enforcement agencies remain focused on tracing these assets to their final destinations and identifying the attackers.
Crystal Intelligence says that the investigation is ongoing and they are tracking all the activities by the attackers. The team is also staying alert for any new methods the attacker might use to further hide the stolen funds.
