15% of Tornado Deposits Are From Ronin Exploiter: Data

The exploiter behind Ronin’s massive $625 million bridge attack has managed to move thousands of ETH to privacy tool Tornado Cash. A month after, what many consider the largest exploit in DeFi history, on-chain data shows that 15% of Tornado deposits are from the Ronin attacker.

This was revealed by Alex Svanevik, CEO of the blockchain analytics platform Nansen.

15% of Tornado deposits are from the Ronin exploiter pic.twitter.com/yYsisOzJvu

— Alex Svanevik (@ASvanevik) April 30, 2022

• On March 23rd, the Axie Infinity play-to-earn gaming platform, Ronin network, suffered an unprecedented attack that led to the loss of over $625 million in USDC and Ethereum (ETH).
• Over the past week, activity from the exploiter’s main address, tagged as Ronin Bridge Exploiter on Etherscan, revealed the continuous movement of Ether to different addresses. The transaction history showed that twenty transfers were made to the same Tornado wallet, each of which sent over 100 ETH.
• Earlier this week, the United States Federal Bureau of Investigation (FBI) revealed that “The Lazarus Group,” associated with the Democratic People’s Republic of Korea (DPRK), was behind the attack.
• The notorious group of hackers was then sanctioned by the Treasury Department.
• Reports suggest that the “The Lazarus Group” is known to use illicit revenues for Pyongyang to fund the totalitarian nation’s nuclear and ballistic missile programs.
• Tornado Cash, which provides transaction privacy by breaking the on-chain link between source and destination addresses, has once again come under fire for aiding many exploiters to conceal their addresses while withdrawing fraudulently gained funds.
• Tansen CEO took a Twitter poll and asked the community members,

“Sensitive topic but curious on how people think: What % of funds would have to be from known exploits/hacks/scams for you to stop using Tornado?”

• Following the attack, Tornado Cash banned the state-sponsored North Korean hacking group from using its mixing service. It earlier said that while “maintaining financial privacy is essential to preserving our freedom,” however, it should not come at the cost of non-compliance.