Partnered With:

How did hackers launder stolen money through Tornado.Cash?

Read this article in 16 Minutes

With the help of SlowMist MistTrack anti-money laundering tracking system, combined with real cases, Tornado.Cash, a currency mixer that popularizes currency laundering techniques.

Original title: "Tracking on the Chain: Tornado.Cash of Tornado.Cash"

Original source: Slow Mist Technology, WeChat Official Account

Some time ago, we released Chain Tracking: Peel Chain of Coin Laundering Techniques, continue the series today. This time the topic is the coin mixer Tornado.Cash.

As the incidents of hackers stealing coins intensified, Tornado.Cash became more and more "famous" ", most hackers mercilessly transfer "dirty coins" to Tornado.Cash after making profits. We have discussed the anonymity of Tornado.Cash, see: Slow Mist AML: "Uncover" the anonymous veil of Tornado.Cash. Today, let's take a real case to see how this hacker laundered coins through Tornado.Cash .

Basic knowledge

Tornado.Cash is a fully decentralized, non-custodial Improve transaction privacy by breaking the on-chain link between source and destination addresses. To protect privacy, Tornado.Cash uses a smart contract that accepts ETH and other Token deposits from one address and allows them to withdraw to a different address, that is, send ETH and other Tokens to any address in a way that hides the sending address. These smart contracts act as pools that mix all deposited assets, and when you put funds into the pool (i.e. deposit), private credentials (random keys) are generated that prove you have performed the deposit operation. Then, this private credential is used as your private key when withdrawing funds, and the contract transfers ETH or other Tokens to the designated receiving address. The same user can use different withdrawal addresses.

Case Study

What we want to analyze today is a real case. The stolen funds on the three chains of BSC and Polygon were all transferred to Tornado.Cash by hackers, so we mainly analyze the part of Tornado.Cash .

Hacker address:

(In order to protect the victim platform, the addresses in the text have been processed)

0x489...1F4(Ethereum/BSC/Polygon)

0x24f...bB1(BSC)

Ethereum Part

With the help of Slow Mist MistTrack anti-money laundering tracking system, we first make a general feature of the address analyze.

These are very important for us to analyze hacker portraits.

Next, we take an in-depth look at funds and behavior on Ethereum Analysis: According to the analysis of SlowMist MistTrack anti-money laundering tracking system, hackers transferred 2450 ETH to Tornado.Cash in batches in the form of 5x10 ETH+24x100 ETH, and transferred 198 ETH to FixedFloat, which allows us to continue to track ;Tornado.Cash Partly keep an eye out.

Since we want to try to trace the address that hackers transferred from Tornado.Cash , we have to use From the time when the first fund is transferred into Tornado.Cash , we found that the time span between the first 10 ETH and the second 10 ETH is relatively large, so we start the analysis with the short 100 ETH.

Locate the transaction corresponding to the Tornado.Cash: 100 ETH contract, and find that there are many addresses transferred from Tornado.Cash . After the analysis of SlowMist MistTrack, we screened out the addresses that match the timeline and transaction characteristics. Of course, there are still many addresses, which requires us to continue to analyze. But it didn't take long for the first address (0x40F...952) that made us suspicious.

According to the analysis of SlowMist MistTrack, the address (0x40F...952) transferred the ETH transferred to it by Tornado.Cash to the address (0x8a1...Ca7), and then divided the ETH into three transactions and transferred to FixedFloat.

Of course, this may also be a coincidence, we need to continue to verify.

Continuing the analysis, it was found that three addresses were Has the same feature:

A→B→(multiple) FixedFloat

A→(multiple) FixedFloat

Based on the evidence of such characteristics, we have analyzed the addresses that meet the characteristics, and there are exactly 24 addresses, which meet our hypothesis .

Polygon part

As shown in the picture below, the hacker transfers part of the 365,247 MATIC that he earned to Tornado.Cash in 7 times.

25,246.721 MATIC went to FixedFloat, which makes us wonder if hackers will do the same to launder coins on Polygon.

We first locate the Tornado:100,000 MATIC contract corresponding to the last three transactions in the above picture, At the same time, it is found that there are not many addresses transferred from the Tornado.Cash contract, so we can analyze them one by one.

Soon, we found the first address (0x12e...69e) that we thought was problematic. We saw the familiar FixedFloat address, not only the FixedFloat transferred MATIC to the address (0x12e...69e), but also the receiving address of the funds transferred from the address (0x12e...69e) also transferred MATIC to FixedFloat.

After analyzing other addresses, I found that they all use the same method of laundering coins, so I won’t go into details here . From the previous analysis, it seems that hackers really have a preference for FixedFloat, but this has also become a handle to catch him.

BSC Section

Let's analyze the BSC part. There are two hacker addresses on BSC, let’s look at the address first (0x489…1F4):

The hacker address transferred 1700 ETH to Tornado.Cash in 17 times, and the time range was relatively consistent. Just when we thought that hackers would repeat their tricks, we found that this is not the case. Similarly, after the analysis and screening of SlowMist MistTrack, we screened out addresses that conform to the timeline and transaction characteristics, and then made breakthroughs one by one.

During the analysis, the address (0x152…fB2) caught our attention. As shown in the picture, according to SlowMist MistTrack, the address transferred the ETH transferred from Tornado.Cash to SimpleSwap.

After further analysis, it is found that the hacker has changed the platform, but the characteristics of the method are still similar:

A→SimpleSwap

A→B→SimpleSwap

< /p>

Another hacker address (0x24f…bB1) was transferred to Tornado.Cash in units of 10 BNB.

In the coin laundering method of this address, the hacker chose another platform, but the method is still similar. I won't analyze them one by one here.

< p dir="ltr" style="text-align: center;">

Summary

This article mainly starts with a real case, analyzes and concludes how hackers try to use Tornado.Cash to clean stolen funds on different chains, this article The secondary coin laundering method is very similar, and the main feature is that after the coin is withdrawn from Tornado.Cash, it is transferred directly or through an intermediate address to the commonly used coin mixing platform (FixedFloat/SimpleSwap/Sideshift.ai). Of course, this is just one of the methods of laundering coins through Tornado.Cash, and more methods are still waiting for us to discover.

Want more To analyze the results more efficiently and accurately, tools must be used. With more than 200 million wallet address tags, SlowMist MistTrack anti-money laundering tracking system can identify various wallet addresses of global mainstream trading platforms, such as user recharge addresses, warm wallet addresses, hot wallet addresses, cold wallet addresses, etc. The MistTrack anti-money laundering tracking system can perform feature analysis and behavioral portraits on any wallet address, which plays a vital role in the analysis and evaluation of anti-money laundering. Strong technical support.