Partnered With:

How did over $90 million of dirty money from Liquid be washed white

Read this article in 10 Minutes

On August 19, 2021, Japanese cryptocurrency trading platform Liquid tweeted that hot wallet had been attacked, that it was currently investigating and that it had suspended its recharge service.

More than $90 million stolen from decentralized Liquid Washing Tools

原文作者： PeckShield派盾

2021 年 8 月 19 日，日本交易平台 Liquid 热钱包中价值 9,000 多万美元加密资产被盗，据 PeckShield「派盾」统计包含：约 480 万美元的 BTC（107.43 枚）、3,250 万美元的 ETH、4,490 万美元的 ERC-20 代币（近百种代币：AAVE、UNI、LINK、SNX、USDC）、183 万美元的 TRON（含 USDT-TRON 和 2,393,334.86 枚 TRON）、1,290 万美元的 XRP（11,467,479 枚）。

According to CoinHolmes, PeckShield's anti-money laundering situational awareness system, ETH tokens have not been changed so far and remain locked in the attacker's address.

The attacker quickly transfers the ERC-20 tokens into the DEXs (decentralized trading platform), such as UniSwap, SushiSwap and 1Inch, and converts nearly 100 tokens into ETH or BTC through Ren bridge. The whole process is very skilled, as can be seen from the attacker's disposal of ERC-20 tokens.

Because some of the stolen ERC-20 tokens have poor liquidity, they are prone to be blocked by the issuer's freeze, transaction rollback or hard fork, etc., the attacker first transfers these tokens into DEXs, which does not require KYC, registration and login, and readjust, and then converts most of the tokens into mainstream token ETH. And funneled to the new address, and then out of the privacy agreement Tornado. Cash.

According to Etherscan, starting at 4:19 am on August 19, the attacker started a "value first" sweep exchange, clearing staboins such as USDT, USDC and DAI, and then transferring them to DEXs before the tokens were frozen.

This is the second time to date that a centralized facility has been stolen and laundered through a decentralized facility. According to PeckShield, there are only a few cases of money laundering through decentralized services after a centralized organization is stolen, but DeFi Protocols attacks and escapes have shown an increasing trend.

Emerging Money Laundering Trilogy

After being successful, the attacker roughly divides the money-laundering process into three steps:

1. Batch transfer: The stolen ERC-20 assets are transferred to DEXs to avoid freezing and rollback, and the stolen assets are integrated to prepare for cleaning in the next step;

2. Bulk exchange: Exchange ERC-20 tokens to ETH or BTC through DEXs or cross-chain bridge, and home the crypto assets through the cross-chain bridge to prepare for bulk transfer to the privacy protocol;

3. Concealment stage: Transfer the placed ETH or BTC to mixed currency tools such as Tornado Cash, Typhoon and Wasabi Wallet to confuse the source of assets and the ultimate beneficiary, erase the traces of illegal assets and confuse the source of assets to escape tracking.

Tornado Cash is a private transaction middleware based on zero-knowledge proof implemented on Ethereum. It uses ZK-SNARK (zero-knowledge Succinct non-interactive Argument of Knowledge) to combine ETH and ERC20 tokens in a non-traceable manner (currently supporting DAI, cDAI, USDC, USDT, WBTC) to any address.

In practice, when a user deposits cryptocurrency into a private pool, they get a deposit certificate, which can then be used to withdraw the previously deposited cryptocurrency from any address. Since the transfer data in the generation and use of the deposit certificate does not include the certificate itself, the two transfers of deposit and withdrawal can be guaranteed to be completely independent. In addition, thanks to the relay service, the Ethereum address doesn't even need to have the ETH to pay for the transfer, so you can withdraw money to a completely blank address.

事实上，Tornado Cash 并非无法破解的隐私协议。前段时间英国警方破获的 DeFi 协议 StableMagnet Finance 跑路案反映出，在安全公司、交易平台、社区和警方的联动下，通过 CoinHolmes 反洗钱态势感知系统对攻击者资产进行持续追踪，在社区持续收集项目方信息，并积极与警方合作的情况下，警方可通过分析追踪社区反馈的线索锁定涉案相关成员，并在物证人证的帮助下，迫使涉案相关成员归还存放在 Tornado Cash 中的 ETH。

According to CoinHolmes, the attackers transferred more than 10 million XRP coins to their addresses in four batches, then transferred them to trading platforms such as Binance, Huobi and Poloniex in three batches.

Liquid traced this information through its Anti-Money Laundering Posture system and immediately contacted these central agencies to blacklist the attacker's address with the aim of urgently freezing the stolen XRP assets.

However, the attacker had already converted some XRPS into BTCS via the exchange. According to CoinHolmes anti-money Laundering situation system, these XRPS had been converted into 192 BTCS and were sent out via Wasabi wallet, a decentralized coin masher.

Wasabi wallet uses a "CoinJoin" approach to aggregate transactions from multiple users into a single large transaction with multiple inputs and outputs. As the number of participating users increases, privacy and reliability increase. Wasabi wallet also uses "block filters" to further disrupt transaction information by downloading entire blocks of data to enhance privacy and resist censorship, making it challenging for law enforcement agencies to track the flow of such funds.

As the regulatory authorities strictly monitor the money laundering situation of the centralized institutions, the centralized institutions constantly increase the demand for KYC, which makes the centralized money laundering channels suffer a heavy blow. The decentralized tools are more and more favored by criminals, and more and more illegal funds begin to turn to the decentralized channels for money laundering. The PeckShield Initiative recommends that relevant law enforcement authorities introduce new regulatory tools and technologies to prepare for further effective efforts to curb money laundering using virtual currencies.

As of September 6, CoinHolmes monitored changes in the attacker's BTC address, with a total of 90 BTC transferred out. CoinHolmes will continue to monitor the transfer of stolen crypto assets.