Phisher who stole $24.2 Million Worth of Ethereum Transfers Funds to Tornado Cash, Peckshield Says

Updated: 13 September 2023

Disclosure

Don’t invest unless prepared to lose all the money you invest. This is a high-risk investment, you shouldn’t expect to be protected if something goes wrong.

Join Our Telegram channel to stay up to date on breaking news coverage

A phisher who stole about $24.2 million of staked Ethereum (ETH) from a crypto whale is transferring the assets to crypto mixing firm Tornado Cash, says blockchain security firm Peckshield.

The stolen cryptocurrencies were liquid staking tokens including Lido Staked Ether (stETH) and Rocket Pool ETH (rETH), Peckshield said.

#PeckShieldAlert The phisher, who grabbed ~$24.2M worth of $rETH & $stETH, has transferred 701 $ETH (~$1.15M) to #TornadoCash

The phisher currently holds $22.7M worth of cryptos, including 13.1K $ETH and 1.1M $DAI pic.twitter.com/GODpSp51wO

— PeckShieldAlert (@PeckShieldAlert) September 8, 2023

The security firm said that the phisher initially transferred 701 Ethereum (ETH) tokens worth about $1.15 million to the cryptocurrency mixer, and then exchanged 28,000 DAI tokens for 17.3 ETH and subsequently moved 1,100 ETH ($1.78 million) to Tornado Cash.

Later, the phisher transferred 2,000 ETH worth about $3.1 million to a new wallet address, and sent 600 ETH to Tornado Cash. Currently, the attacker holds a total of $22.7 million in various cryptocurrencies including 13,100 ETH and 1.1 million DAI tokens, Peckshield said.

Update: The phisher transferred 2,000 $ETH ($3.1M) to a new address 0x71C8…790e, ~600 $ETH was sent to #TornadoCash. pic.twitter.com/IkqASk5pvi

— PeckShieldAlert (@PeckShieldAlert) September 12, 2023

Peckshield said on Sept. 7 that the attacker exchanged the stolen assets for 13,785 ETH and 1.64 million Dai (DAI), a stablecoin valued at $1.00. A considerable portion of the acquired DAI has already been moved to FixedFloat, a fully automated cryptocurrency exchange.

Legal Challenge and Sanctions

Tornado Cash was sanctioned in August last year for its alleged involvement in money laundering, a practice it was accused of since its establishment in 2019. The Justice Department says it was responsible for enabling over $1 billion in money laundering activities, with a significant portion of these funds believed to have benefitted North Korea’s Lazarus Group.

U.S. authorities say that the Lazarus Group’s illicit actions have provided financial support to North Korea’s nuclear weapons and ballistic missile programs.

Last month, a court decision in the US reaffirmed sanctions against Tornado Cash. Six Tornado Cash users had challenged these sanctions, but the court upheld the ban, ruling that the plaintiffs’ claims of constitutional violations were not compelling enough.

Tornado Cash’s Private Ethereum Transactions

Tornado Cash provides a platform for users to make their Ethereum transactions more private. This is done by combining their funds with those from other cryptocurrency holdings. This process effectively hides the origin of a cryptocurrency transaction, making Tornado Cash an attractive option for cybercriminals seeking to convert their ill-gotten gains.