Heco Bridge Masterminds Funnel $145M through Tornado Cash

Recent on-chain data reveals that hackers who exploited the Heco Bridge last year have successfully laundered over $145 million worth of ether in the past eight days using Tornado Cash, a cryptocurrency mixer known for providing privacy by masking transaction origins and destinations.

The Heco Bridge serves as a conduit for transferring funds between Ethereum and the Heco Chain, a blockchain established by the HTX exchange (formerly Huobi).

PeckShield, a blockchain security and data analytics firm, reported the staggering amount of ether transferred to Tornado Cash, thereby revealing the magnitude of the ongoing laundering operation. The November 2023 Heco Bridge exploit inflicted substantial losses with estimates placed at around $111 million on the day of the hack, as reported by PeckShield. 

Ethereum, USDT, USDC, and HBTC Siphoned

Various funds were siphoned during the attack including ether, USDT, USDC, and HBTC. These were swiftly funneled to decentralized exchanges and converted into other tokens.

Igor Igamberdiev, Wintermute’s Head of Research, flagged some dubious transactions that amounted to $23.4 million, suggesting a possible secondary exploitation of HTX after the Heco Bridge event. Noteworthy is HTX’s action of transferring funds from a hot wallet to a specified recovery wallet while temporarily pausing deposits and withdrawals. This raised concerns among members of the cryptocurrency community.

HTX’s Post-Breach Recovery and Investor Confidence

HTX advisor Justin Sun had reassured users of the platform’s security after the attack occurred, pledging full compensation for losses incurred by them in HTX’s hot wallets. However, the incident worsened existing unease, especially as it came on the heels of a 5,000 ETH hack targeting HTX in September 2023.

Nevertheless, in December last year, HTX after resuming operations following a significant security breach in the previous month, witnessed a considerable net outflow of $248 million, prompting inquiries into investors’ confidence in the exchange’s post-breach recovery.

Tornado Cash Developers under Scrutiny

In a separate development, Tornado Cash developer Alexey Pertsev will face legal scrutiny after being accused of laundering $1.2 billion in illicit funds through the platform. Pertsev is currently awaiting trial in the Netherlands on charges that are related to money laundering and other financial crimes, with proceedings scheduled for March 26.

His cofounder, Roman Storm on the other hand was granted bail and released soon after being detained by the US Department of Justice (DOJ) on August 23 2023 over accusations of money laundering and other infractions.