Hackers Move Nearly 18,000 ETH Through THORChain, Cash Out $44.94M in DAI

A fresh surge of activity on the blockchain has been capturing the attention of the crypto community, as hackers keep targeting decentralized protocols to wash their stolen gains.

In an apparent coordinated effort, they moved 17,778.7 ETH today across THORChain and exchanged it for DAI before you could say “cross-chain platform,” raising new questions about the participation of illicit actors in facilitating financial flows across the crypto ecosystem.

This morning, on-chain monitors saw a wallet disposing of 8,698 ETH for 22.12 million DAI, at a spot price of $2,543.40 per ETH. What caught observers’ attention was not just the volume but the provenance of the ETH. Just 90 minutes before it went to the wallet we were watching, it had been sent from THORChain, a decentralized cross-chain exchange platform that has increasingly come under scrutiny for its usefulness in laundering hacked or stolen funds.

Although THORChain provides a powerful protocol for facilitating seamless cross-chain swaps without the need for centralized intermediaries, it has also become a favorite tool for bad actors looking to obfuscate the source of illegal crypto. Its decentralized nature makes it that much easier for traces of illicit deeds to be covered up once the assets have been bridged across chains.

Within hours, blockchain analysts confirmed that another 9,080.7 ETH tied to the same campaign was also routed through THORChain and sold for 22.82 million DAI. In total, across two coordinated sales, 17,778.7 ETH was dumped in exchange for 44.94 million DAI, averaging a price of approximately $2,528 per ETH.

The new activity is thought to be connected to hackers behind a number of recent high-profile security breaches, such as the attack on Coinbase that compromised user accounts and the $40 million heist from Bybit. On-chain intel providers believe the ETH sold today was either directly tied to or strongly correlated with funds taken in those incidents.

It is worth mentioning that the Bybit hacker used a comparable money laundering operation, trying to cover his trail and the large amount of ETH he was shuffling around. Today’s activity rescues the appearance of the Bybit hack almost frame by frame. It starts with assets moving onto THORChain and finishes with those same assets being converted into DAI, a stablecoin that might as well have “for hackers” stamped on it.

Even though the identity of the hackers is still unknown, indications are that they are a coordinated group using decentralized infrastructure to stay one jump ahead of the authorities. This is probably from an unnanmed source that keeps the risk down for any hacker group that might wish to use it for under-the-radar money moves.

The fact that these launderers sent out two big batches to cash out at different prices suggests they know what they’re doing—and might even be working with some inside information.

DeFi is thrilled with THORChain’s cross-chain capabilities, but it is fast becoming a mainstay in controversies over illegal activities. By letting users swap assets across blockchains while staying completely anonymous, it gives shady types a way to launder cryptocurrency, making it seem as though the tokens they stole had never really been stolen at all. As for what happens to those tokens next, THORChain is not in a position to judge, for all it knows those tokens are being swapped for nice, clean stable coins like DAI or USDC.

Although THORChain functions as a neutral protocol, events like this one really call into question what DeFi stands for: when even the best-behaved DeFi protocols must contend with subpar actors in the crypto space, they seem to be that much closer to the kind of (or, perhaps, the only kind of) financial integrity that decentralization delivers — and that surely privacy, the other principle in DeFi’s promise, also delivers.

Today’s movement spans an almost $45 million nearly two-hour window. It has once more stoked discussions around the need for better oversight and tracking tools to monitor shady happenings on platforms like these. And it has thrust into the limelight the need for better on-chain analytics in DeFi.

The problem is an apparent lack of alternative methods of achieving these ends. Without them, it’s going to be nearly impossible to improve any of the aforementioned mechanisms.

An official statement regarding today’s incident is still awaited from the authorities. But experts in the field are sounding alarms. They say the continual growth in the sophistication of laundering strategies means even the most advanced, state-of-the-art protocols—like THORChain—won’t be able to squeak by unscathed if incidents like today’s keep happening. And these experts do not see such events stopping anytime soon.

While the situation continues to evolve, the crypto industry and affected platforms like Coinbase and Bybit are predicted to reinforce internal controls and to rethink, maybe, how decentralized tools interact with risk management in a landscape where threats develop almost as fast as the platforms themselves.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.

Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!

The post Hackers Move Nearly 18,000 ETH Through THORChain, Cash Out $44.94M in DAI appeared first on The Merkle News.