Heco Bridge Hackers Launder $145 Million Through Tornado Cash

Hackers who breached the cross-chain Heco Bridge in 2023 laundered approximately 40,392 ETH through the mixing service Tornado Cash. This was highlighted by experts at PeckShield.

#PeckShieldAlert As of today (22 Mar. 2024, UTC), #HECOBridge exploiters — labeled addresses — have transferred ~$40,391.8 $ETH (equivalent to ~$145.7m) to #TornadoCash within the last 8 days pic.twitter.com/ZfrDvbRQCm

— PeckShieldAlert (@PeckShieldAlert) March 22, 2024

The value of the cryptocurrency transferred over the past eight days amounted to $145.7 million at current market prices.

The bridge facilitates asset transfers between Ethereum and Heco Chain — a blockchain supported by the HTX exchange. The protocol and the trading platform’s hot wallet were attacked in November.

PeckShield initially noticed the withdrawal of 10,145 ETH from Heco Bridge. They estimated the damage at that time to be ~$111 million in various cryptocurrencies.

Igor Igamberdiev, head of research at Wintermute, suggested there was an additional $23.4 million exploit on HTX. He observed that unauthorized transactions occurred immediately after the Heco Bridge attack and followed a similar pattern.

HTX advisor Justin Sun confirmed the breach of the trading platform’s wallet and the cross-chain protocol.

The exploit ranked as the fourth largest in 2023 in terms of damage within the crypto industry. Overall, project losses from over 600 incidents reached $2.61 billion, according to PeckShield.

In August 2022, the U.S. Treasury’s Office of Foreign Assets Control added Tornado Cash to its sanctions list. According to the agency, since the service’s inception in 2019, criminals have transferred over $7 billion in cryptocurrencies through it.

In the same month, Dutch authorities arrested the protocol’s developer, Alexey Pertsev.

In 2023, the U.S. Department of Justice charged two co-founders of Tornado Cash, Roman Storm and Roman Semenov. The former was later released on bail. The latter remained free but came under sanctions.

Since January 2024, Storm and Pertsev have been raising $1.5 million for legal defense. For this purpose, the JusticeDAO fund was created. In February, the crowdfunding platform GoFundMe halted fundraising for Tornado Cash, citing risks to its users.

In March, Dutch authorities charged Pertsev with facilitating the laundering of $1.2 billion in illicit funds.