Kronos Research hacker shifts funds to Tornado Cash

Kronos Research was exploited for $25 million in November last year, and one of the six wallets linked to the hacker started moving funds to Tornado Cash on May 7.

The exploiter behind the $25 million exploit of quantitative trading firm Kronos Research in mid-November last year has started to move funds nearly six months after the exploit.

The hacker wallet address first transferred 1,314 Ether (ETH) worth $4 million to a new address, starting with 0x8F5e4 and later transferred all the ETH to another address starting with 0x164A24b.

The hacker made 10 transactions of 100 ETH from the final wallet and transferred it to Tornado Cash, a crypto-mixing tool.

Tornado Cash is an open-source cryptocurrency tumbler that operates on networks compatible with the Ethereum Virtual Machine. The mixing services obscure the path of the crypto transactions and make it extremely difficult to trace the original source of the funds.

Although created as a privacy tool, hackers often use these mixing services to launder stolen funds via decentralized exchange platforms.

The significant usage of Tornado Cash for transferring illicit funds prompted the United States government to impose sanctions on its use in August 2022. Subsequently, its founders were charged with money laundering and sanctions violations a year later.

Related: Five US enforcement agencies form new digital currency anti-crime task force

While opinions within the crypto community vary regarding the adoption of privacy tools, there is a consensus against governmental persecution of developers and creators solely for creating an application.

The crypto analytics firm PeckShield raised an alert regarding the transfer of funds on X and cautioned that the transfer to Tornado Cash suggests that the hacker is attempting to launder the stolen funds.

Over the years, exploiters have chosen crypto-mixing services over centralized exchanges as once they are identified, addresses are blocked by exchanges.

Kronos Capital was exploited in November 2023 after the exploiters managed to gain access to the firm’s API keys. The firm first denied any loss of funds during its early announcement.

Later, on-chain investigator ZachXBT revealed that roughly 12,800 ETH worth $25 million was stolen and transferred into six unique crypto wallet addresses. Kronos Capital halted its trading services to investigate the loss.