In April 2023, the cryptocurrency exchange Bitrue was hacked, resulting in the loss of approximately $23 million worth of digital assets, prominently including Ethereum (ETH). Over a year later, the hacker resurfaced, laundering more than $30 million of stolen ETH through Tornado Cash, a decentralized Ethereum mixer that obscures transaction origins.
On-chain analysts, particularly crypto analytics firm EmberCN, traced the hacker's activities, revealing an intricate laundering strategy. Initially, the stolen ETH was sold at approximately $3,885 per ETH, netting roughly $16.34 million, which was then converted into the stablecoin DAI. Subsequently, when ETH prices dropped to around $1,472 in April 2024, the hacker repurchased ETH, and as prices rose back above $2,800, the hacker consolidated gains and again used Tornado Cash to obscure the asset trail.
Large deposits to Tornado Cash have been recorded recently, suggesting ramped laundering activity. Some of these funds were also moved to HyperLiquid, a decentralized derivatives platform, possibly for leveraged trading or additional obfuscation.
The Tornado Cash protocol has been sanctioned by the U.S. Treasury since August 2022 due to its facilitation of illicit money laundering, including activity linked to North Korea’s Lazarus Group. Despite the sanctions, its smart contracts remain active on Ethereum, continuing to attract use by criminals.
This case highlights ongoing challenges in the cryptocurrency ecosystem regarding security breaches, laundering tools, and regulatory enforcement. Bitrue has promised to cover user losses and remains solvent, though the hacker’s identity remains unknown and no stolen funds have been recovered yet.
Experts emphasize the critical need for enhanced exchange security, robust regulatory responses, and innovative on-chain monitoring to deter criminal behavior. The dynamic between privacy tools like Tornado Cash and investigative analytic methods continues to evolve, impacting the broader dialogue on balancing privacy and security in crypto.