The Ronin Bridge hacking attack that took place last March showed that most of the stolen Ethereum (ETH) funds were transferred to Bitcoin (BTC) using renBTC including Bitcoin privacy tools Blender and ChipMixer.
The hacker's activity was tracked by chain investigator 'BliteZero' working for SlowMist. The aim is to outline the transaction path of funds stolen since the March 23 attack.
Most of the stolen funds were originally converted to ETH and sent to the Ethereum crypto mixer Tornado Cash before being connected to the Bitcoin network and converted to BTC via the Ren protocol.
Additionally, hackers believed to be from the North Korean cybercrime organization Lazarus Group transferred a portion of funds totaling 6,249 ETH to centralized exchange platforms including Huobi (5,028 ETH) and FTX (1,219 ETH).
According to the platform, 6249 ETH was converted to BTC, then the hacker transferred 439 BTC worth $20.5 million to Bitcoin privacy tool Blender.
Analysts also noted that the Ronin hacker had deposited all his production funds into Blender after withdrawing from the exchange. Nevertheless, 175,000 ETH of the stolen funds were transferred to Tornado Cash in stages between April 4 and May 19.
Accordingly, the hacker used decentralized exchanges Uniswap and 1inch to convert 113,000 ETH to renBTC and used a decentralized cross-chain bridge to transfer Ethereum assets to the BTC network.
Reports also state that the Ronin hacker has withdrawn 2,871 BTC through Bitcoin privacy tool ChipMixer.
