Stolen Funds From HECO Bridge Exploit Moved

In August 2022, the US Treasury Department’s Office of Foreign Asset Control (OFAC) imposed sanctions on Tornado Cash, prohibiting its usage for US citizens, residents, and companies. But this has not deterred hackers from moving stolen funds through the controversial crypto tumbler to obfuscate tracking.

In fact, PeckShield’s latest update reveals that exploiters of the HECOBridge have moved over 40,391 ETH, valued at around $145.7 million, executing 19 outgoing transactions to Tornado Cash in the past 8 days.

PeckShield Flags Tornado Cash Activity

The HECO cross-chain bridge was exploited in November 2023. The compromised funds, comprising Ether, USDT, USDC, and HBTC, were promptly transferred to decentralized exchanges and exchanged for altcoins.

Further investigation revealed an additional exploit involving HTX, with suspicious transfers totaling $23.4 million observed shortly after the Heco Bridge attack, displaying similar patterns. Exactly four months later, PeckShielf flagged movements of illicit funds through Tornado Cash.

The blockchain security firm’s update on March 22nd stated,

“#PeckShieldAlert As of today (22 Mar. 2024, UTC), #HECOBridge exploiters – labeled addresses – have transferred ~$40,391.8 $ETH (equivalent to ~$145.7m) to #TornadoCash within the last 8 days.”

Earlier this week, CertiK flagged a 3,700 ETH deposit into Tornado Cash, valued at $10 million, drawing attention due to its association with a phishing attack from September 2023. The funds were stolen from an unknown crypto whale.

Tornado Cash witnessed a 93% decline in monthly inflows post-sanctions compared to pre-sanctions averages, according to a recent report by Chainalysis.

These developments suggest that despite facing a major setback, some unlawful actors remain undeterred, indicating that while the sanctions presented a challenge, they did not entirely halt all illicit activities, owing to its decentralized setup.

Tornado Cash Devs’ Fates Hang in Limbo

Earlier this week, a Netherland indictment accused Tornado Cash developer Alexey Pertsev of laundering $1.2 billion of illicit funds through the crypto mixing platform.

Besides the Russian national who was jailed in the Netherlands in August 2022, two other Tornado Cash developers, Roman Storm and Roman Semenov, are facing similar allegations of money laundering and sanctions violations in the United States.