Kronos Research Exploit Funds Funneled Through Tornado Cash Despite Sanctions

After six months, those behind the $25 million Kronos Research exploit have initiated the transfer of the stolen funds. PeckShield, a blockchain security firm, detected the movement on May 7, observing that the hackers were directing the funds towards the mixing platform Tornado Cash.

Tornado Cash, renowned for its role in mixing crypto funds from various sources, poses challenges in tracking the origin of assets, making it a favored choice among bad actors for laundering illicit gains. Despite facing sanctions from the U.S. Department of the Treasury’s Office of Foreign Assets Control in August 2022, the platform continued to thrive, laundering over half a billion dollars worth of crypto in 2023 alone.

The creators of Tornado Cash have themselves faced accusations of laundering stolen crypto assets but have contested the allegations and moved to dismiss them.

The Kronos Research hacker initially transferred 1,314 Ether to a new address before directing the funds to another wallet, which subsequently initiated transactions to the crypto-mixing platform. The exploit, disclosed by Kronos Research on November 18, involved the use of stolen API keys to execute the attack.

Despite attempts to negotiate with the hacker, including offering a 10% bounty for the return of the remaining 90% of the funds, no agreement was reached.

While crypto thefts were on the rise at the start of 2024, recent reports indicate a decline in the trend, with April seeing a 67% drop compared to March, and March itself recording a 50% reduction compared to February.