Kronos Research hacker shifts funds to Tornado Cash

As a researcher with a background in cybersecurity and blockchain technology, I find this recent development in the Kronos Research exploit case both intriguing and concerning. The fact that the hacker responsible for the $25 million theft has started moving funds six months later through crypto-mixing services like Tornado Cash is a common tactic used to obscure the origin of illicit funds.


As a researcher studying financial crimes, I’ve uncovered new information regarding the individual responsible for the $25 million exploit of Kronos Research, which occurred around mid-November last year. Recently, this person has initiated the transfer of funds from the ill-gotten gains, approximately six months following the initial hacking incident.

As a researcher investigating transactions related to a specific hacker’s Ethereum wallet, I uncovered that an initial transfer of 1,314 Ether (ETH), equivalent to approximately $4 million at the time, was made from the wallet to a newly generated address starting with “0x8F5e4”. Subsequently, all the ETH in that wallet was then transferred to another address, which began with “0x164A24b”.

Kronos Research hacker shifts funds to Tornado Cash

As a researcher investigating a recent cryptocurrency transaction, I’ve uncovered that an individual, suspected to be a hacker, executed ten separate transactions, each involving 100 Ether (ETH), from the final wallet. This activity was not directed towards any specific recipient, instead, the ETH was forwarded to Tornado Cash – a well-known crypto-mixing service designed to obfuscate the origin of digital currency transactions.

Kronos Research hacker shifts funds to Tornado Cash

Open-source platform Tornado.cash allows users to mix their Ethereum Virtual Machine (EVM)-compatible cryptocurrency transactions, making it hard to follow the money trail back to its origin. This service anonymizes crypto transfers by mixing them with other transactions.

Hackers frequently exploit cryptocurrency tumblers, initially designed for enhancing anonymity, to cleanse ill-gotten gains through decentralized trading markets.

In August 2022, the US authorities took notice of Tornado Cash being widely utilized for illicit fund transfers and responded by imposing sanctions on it. Consequently, its creators faced money laundering and violation of sanctions charges in the following year.

Among cryptocurrency enthusiasts, views differ on the use of privacy tools. however, there’s a broad agreement that developers and innovators should not face harassment or prosecution by governments merely for developing an application.

PeckShield, a cryptocurrency analysis company, issued a warning about a transaction on the X platform. They noted that the funds being transferred to Tornado Cash are suspected to be part of an attempt by a hacker to conceal illegally obtained funds.

For some time now, individuals looking to obscure their cryptocurrency transactions have opted for mixing services instead of using centralized exchanges. The reason being, when their identities are uncovered, the associated addresses get blacklisted by the exchanges.

In November 2023, unauthorized individuals infiltrated Kronos Capital and obtained our API keys. Initially, we issued a statement denying any financial losses during the early stages of the incident.

Subsequently, cryptocurrency detective ZachXBT disclosed that approximately $25 million in Ethereum (12,800 ETH) had been pilfered and moved into six distinct digital wallets. In response, Kronos Capital suspended its trading activities to conduct an investigation regarding the monetary shortfall.

Read More

2024-05-07 11:00