THORChain Becomes a New Money Laundering Method for Crypto Hackers

Overview

Following a series of high-profile cyberattacks, on-chain data reveals that in the past four months, over 50% of the stolen ETH has been converted to Bitcoin through THORSwap Router on the THORChain network.

Detailed Analysis

According to an analysis by @tayvano_ on X (formerly Twitter), hackers from Russia/CIS and North Korea are increasingly using THORChain to convert stolen Ethereum (ETH) to Bitcoin (BTC).

Approximately 34,583 ETH (worth $57 million) of stolen funds were converted to BTC through THORSwap over the past four months. This constitutes about 65% of the total ETH volume transacted on THORSwap during this period, which totaled 53,183 ETH (worth $88 million). Additionally, at least 3,300 ETH were laundered directly through Tornado Cash and Railgun.

Transaction Data

Dune Analytics data compiled by @tayvano_ shows more than 39,800 transactions linked to various hacks. Notably, addresses tagged as "FTX Account Drainer" and "Hack Stake Thor" were heavily involved in these activities.

Breakdown of Major Hacks:

1. FTX Hack:

Six addresses linked to the FTX hack interacted with THORChain, swapping over 19,944 ETH (approximately $32 million).

2.Stake.com Hack:

In early September, Stake.com lost over $40 million to hackers, including 8,143 ETH and 1.64 million USDT ($15 million), laundered through THORChain.

3.Seed Phrase Leak:

A hacker from Russia stole 7.1 million USD (4,195 ETH) from multiple addresses due to a seed phrase leak. More than 20 wallets were involved in swapping stolen ETH on THORSwap.

4.Private Key Leak:Another hack involved the theft of 1,958 ETH ($3.3 million), leading to a significant spike in volume on THORSwap.

5.Nirvana Finance Flashloan Attack:

On July 28, 2022, Nirvana Finance was attacked via flashloan, losing over $3.57 million. Of this, 259 ETH ($400,000) was swapped on THORSwap across eight transactions.

6. Atomic Wallet Hack:

• On July 28, 2022, Nirvana Finance was attacked via flashloan, losing over $3.57 million. Of this, 259 ETH ($400,000) was swapped on THORSwap across eight transactions.

• North Korean hacker group Lazarus was linked to a $100 million attack on Atomic Wallet in June, laundering 84 ETH ($150,000) through THORChain.

Community Reaction

While THORChain's decentralized solution aligns with crypto principles, it is increasingly being exploited by malicious actors, raising concerns about regulatory crackdowns similar to those experienced by Tornado Cash.

Conclusion

THORChain's rise as a tool for laundering stolen crypto assets underscores the need for robust security measures and regulatory oversight to prevent misuse while maintaining the decentralized ethos of blockchain technology.