Review the whole process of Ronin's stolen money transfer in the "Great Heist": Only about 1.8 ETH are left in the original attack wallet

Written by: iambabywhale.eth

Written by: iambabywhale.eth

On May 4th, Ronin Network hackers transferred 12595.3 Ethereum to the new address (0x08723392ed15743cc38513c4925f5e6be5c17243) at 15:32:25 Beijing time. So far, almost all of the 173,600 Ethereum stolen from Ronin Network have been transferred out, leaving only about 1.8 Ethereum in the original attack wallet.

In the attack on Ronin Network that occurred at the end of March, the amount stolen from the protocol reached 610 million US dollars, surpassing the 600 million US dollars of Poly Network last year and becoming the largest hacking incident in the history of DeFi. The attackers only moved and laundered the stolen funds for more than a month. Let's review the transfer of stolen money and the progress of this "Great Robbery".

On March 29, Ronin Network, a dedicated Ethereum sidechain for Axie Infinity, said on Twitter that it had discovered earlier in the day that Sky Mavis's Ronin validator node and Axie DAO validator node had been attacked on March 23, losing a total of 17.36 10,000 Ethereum and 25.5 million USDC.

On March 30, SlowMist issued a document stating that the funds for the hacking attack came from Binance withdrawals, and that 25.5 million USDC had been traded for 6,250 Ethereum, and decentralized transfers had been carried out, of which 1,221 ETH were transferred to FTX and Crypto.com.

Later that day, the hacker transferred 3,750 Ethereum to Huobi again.

On April 4, hackers transferred 1,000 Ethereum from the attack address (0x098B716B8Aaf21512996dC57EB0615e2383E2f96) to another address (0xbc25d57412a04956CDD95AF07825C5C1F34d29eb), and then transferred 200 of them to Transfer to Tornado Cash.

On April 5, the hacker transferred 1526 Ethereum from the attack address to the new address (0xdf225c84a0eaeaaac20e6c1d369e94ee13b9df2a), and transferred them to Tornado Cash in batches.

On April 6th, SlowMist issued a document stating that between 17:49:06 UTC on March 31st and 6:05:58 on April 6th, the hacker transferred 1233.9811 Ethereum to Huobi again, and transferred a total of 1233.9811 Ethereum to Tornado Cash Transfer 4400 Ethereum.

On April 7th, SlowMist posted that from 6:19:03 UTC on April 6th to 7:08:59 on April 7th, Ronin Network attackers transferred 2,800 Ethereum to Tornado Cash.

On April 8, hackers transferred 4800 Ethereum to Tornado Cash through the intermediate address (0x5b0431365ce1ab3693bea6f33ae67653dd30d8bd).

On April 9, hackers transferred 3002.985 and 3102.6215 Ethereum to two addresses (0x1361c1e18930483F4Aaf91f3a263937e4Fcc1f39, 0xBCD78C2D608e7cEB3d25Bea30faE8a9D57033868), respectively. All were subsequently transferred to Tornado Cash.

On April 10, the hacker transferred 3002 Ethereum to 0x1361c1e18930483F4Aaf91f3a263937e4Fcc1f39, and then transferred all of them to Tornado Cash.

On April 12, the hacker transferred 2941 Ethereum to the new address (0xb2369D20e7f0C46270b9F79ab26Fc62fadA356c7), and then transferred to Tornado Cash. At present, there are still about 40 Ethereum remaining at this address.

On April 13, the hacker transferred 3202 Ethereum to the new address (0x77532dd2eb6e8eaf416f39c65f48cd2369782828), and then transferred to Tornado Cash.

On April 14, the hacker transferred 3302.6 Ethereum to the new address (0x1Bf53ce80FF2ed5711b8A2DB8f7EA5b38DA118d6), and then transferred to Tornado Cash.

On April 15, according to the Wall Street Journal, the U.S. Department of the Treasury said that the Lazarus Group, a criminal group related to the North Korean government, was the owner of the cryptocurrency address in the Ronin Network attack. A Treasury spokesman said anyone transacting with sanctioned wallets would be at risk of U.S. sanctions.

On the same day, PeckShield stated on Twitter that hackers have transferred about 28,000 Ethereum from the attack address to Tornado Cash, accounting for 16% of the total. There are about 147,753 Ethereum remaining in the wallet.

Later that day, the hacker again transferred 2,900 Ethereum to the new address (0xBc5639887283eaF1B8E966e0b2fa6998D2ec6404), and then transferred to Tornado Cash.

On April 18, the hacker transferred 10129.9 Ethereum to the new address (0x3cffd56b47b7b41c56258d9c7731abadc360e073).

On April 19, hackers transferred 18256.8 Ethereum to 0x1Bf53ce80FF2ed5711b8A2DB8f7EA5b38DA118d6.

On April 21, hackers transferred 21629 Ethereum to 0x53b6936513e738f44fb50d2b9476730c0ab3bfc1.

On April 22, the hacker transferred 1528.2 Ethereum to the new address (0x8fa7b50fc8306ab3de028254df72bf08216742b6) through the intermediate address (0x3cffd56b47b7b41c56258d9c7731abadc360e073).

On April 24, the hacker transferred 33568 Ethereum to the new address (0x35fb6f6db4fb05e6a4ce86f2c93691425626d4b1).

On April 26, PeckShield issued an article saying that according to statistics, as of April 26, 65% of the stolen funds had been transferred out of the Ronin Network attacker wallet, of which 22% (about 39,700 Ethereum) was laundered through Tornado Cash, about 41 % transferred to 3 new wallets.

On April 27, the hacker transferred 18256.8 Ethereum to the new address (0x5967524CE3Bc2BC422e584e33bD50921A22e3c0a).

Later that day, the hacker again transferred 25127.5192 Ethereum to the new address (0xf7b31119c2682c88d88d455dbb9d5932c65cf1be).

On April 28, the Ethereum sidechain Ronin Network released a vulnerability report saying that hackers used phishing attacks on Sky Mavis to infiltrate Sky Mavis IT infrastructure and gain access to verification nodes, and discovered a backdoor through Gas-free RPC nodes , and obtained the signature of Axie DAO verification nodes, thus controlling 5/9 verification nodes.

Ronin Network stated that Sky Mavis’ current security measures include working with security companies to build defense systems, increasing the number of verification nodes, implementing stricter internal control procedures, conducting audits, establishing trustless organizations, launching bug bounties, and conducting ISO27001 and other security measures. Safety-related certifications. In addition, Ronin Network is expected to deploy upgrades by the end of April and officially open in late May, and all stolen funds will be secured by recent Sky Mavis financing, Axie Infinity and Sky Mavis assets, and personal funds from the core team.

On April 29, the hacker transferred 5,000 Ethereum to the new address (0xDD6458eB5090832eB88BFfc7AdF39B0F3CdD6683), and then transferred to Tornado Cash.

On May 3, the hacker transferred 23528.8 Ethereum to the new address (0x3e37627deaa754090fbfbb8bd226c1ce66d255e9) at 16:23:28 Beijing time.