Harmony Attack: Exploiter mixes stolen funds using Tornado Cash to come clean

Last week, when TheCoinRise wrote the attack on Harmony layer-1 blockchain’s Horizon Bridge, it reported that the company lost at least in altcoins. The attacker(s) swapped most of these altcoins into Ethereum.

According to a recent development, we’ve found that the stolen funds have started to move into the Tornado Cash Ethereum mixer, which clearly means that the attacker has no intention of considering accepting $1 million bounties. 

#PeckShieldAlert ~6k $ETH (~$7.3m) into 0x432…47ae from @harmonyprotocol exploiters and start transferring to @TornadoCash
Intermediary address: 0x1e…6430 pic.twitter.com/cN1nZwPi6I

— PeckShieldAlert (@PeckShieldAlert) June 27, 2022

The Harmony team’s decision to hide the illicit earnings offers an answer to the question of whether their offer of just 1% of the $100 million in cryptocurrency funds taken on June 24 would be sufficient to persuade the exploiter to return them.

Harmony attacker mixing funds fast

At 03:10 ET on June 28, a total of 18,036.3 ETH, or nearly $21 million, were transferred out of the Harmony exploiter’s primary wallet. Over the course of the following 10 hours, these funds were equally divided into three separate transactions and sent to three distinct addresses.

Since Tornado Cash can only mix up to 100 ETH at once, mixing up enormous amounts of money can easily take many hours. The purpose of mixing ETH is to obscure the transaction path of coins so that they cannot be tracked back to earlier transactions, and this technique is often used by attackers to come clean.

The first and second wallets that got Ethereum from the exploiter’s main wallet have finished mixing the funds and are currently sitting on a total of 16.3 ETH, which is probably not enough to warrant their attention. On the other hand, the third wallet is actively transferring 100 ETH batches at a time to Tornado, with 2,800 coins remaining in it.

On June 27, the Twitter account of Harmony reiterated that the team was collaborating with “two highly reputable blockchain tracing and analysis partners” in addition to the FBI to look into the attack.