{"id":48163,"date":"2021-08-23T18:51:15","date_gmt":"2021-08-23T15:51:15","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=48163"},"modified":"2025-09-02T00:52:01","modified_gmt":"2025-09-01T21:52:01","slug":"hacker-behind-liquid-breach-sent-nearly-20m-in-ethereum-to-tornado-cash-mixer","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/hacker-behind-liquid-breach-sent-nearly-20m-in-ethereum-to-tornado-cash-mixer\/","title":{"rendered":"Hacker behind Liquid breach sent nearly $20m in Ethereum to Tornado Cash mixer"},"content":{"rendered":"<p>The hacker who breached the Bitcoin exchange Liquid sent Ethereum worth almost $20 million to the Tornado Cash transaction mixer, <a href=\\\"https:\/\/www.elliptic.co\/blog\/liquid-exchange-hacked-94-million-stolen\\\">reported<\/a> by Elliptic, the blockchain analytics firm.<\/p>\n<p>On August 19, the Japanese exchange reported the <a href=\"https:\/\/forklog.com\/en\/news\/liquid-bitcoin-exchange-hacked-for-80-million\">hack<\/a>. Initially, the loss was estimated at $80 million. Elliptic researchers together with the exchange&#8217;s team refined the losses \u2014 they amounted to just over $97 million.<\/p>\n<figure class=\\\"wp-block-image\\\"><img decoding=\\\"async\\\" src=\\\"https:\/\/lh4.googleusercontent.com\/GuXM_86SBZIwp7jDQMiryO4gu5KqBcwkYaw25feWzbbQxugSQXjz7MvOl9iKjRAupVw_GP13eKnWjoUyQhL4tJd8LeSxPXU-W1wcrSPV2mi6wszpiCwNdVpYH1vBhJDCLludH_-y\\\" alt=\\\"The Liquid hacker sent about $20 million in Ethereum to the Tornado Cash mixer\\\"\/><figcaption>Data: Elliptic.<\/figcaption><\/figure>\n<p>The analysts noted that the hacker is also attempting to convert ERC-20 tokens worth a total of $45 million into Ethereum to avoid blocking by projects that have such capability. To do this, the attacker uses decentralized exchanges, including Uniswap and SushiSwap. <\/p>\n<p>In Liquid <a href=\\\"https:\/\/blog.liquid.com\/warm-wallet-incident\\\">stated<\/a> that the stolen assets in Ethereum-tokens worth about $17.4 million have already been frozen. The team noted that the attack affected 69 different coins in total.<\/p>\n<p>According to <a href=\\\"https:\/\/www.coindesk.com\/liquid-exchange-hacker-covers-tracks-by-sending-20m-to-eth-mixer\\\">CoinDesk<\/a>, the attacker is attempting to launder funds through centralized exchanges. In several transactions he transferred TRON tokens worth about $1 million to an address belonging to Huobi. A platform representative said that the account was restricted and an internal investigation has begun.<\/p>\n<p>11.5 million XRP worth about $14.5 million was sent to Binance, Huobi and Poloniex.<\/p>\n<p>The Liquid team traced that on one exchange he sold Ripple tokens for Bitcoin and withdrew the cryptocurrency to two addresses that now hold 192 BTC.<\/p>\n<blockquote class=\\\"twitter-tweet\\\" data-lang=\\\"en\\\">\n<p lang=\\\"en\\\" dir=\\\"ltr\\\">Update:<br \/>We are currently tracing the movement of the assets and working with other exchanges to freeze and recover funds.<\/p>\n<p>Attacker deposited XRP via another exchange and withdrew BTC to these 2 addresses:<br \/>12PKkwoFkXp6JtN7roWRA2gSitE6nVDds4<br \/>1JW1tcBXp1vZ6KGEirFNSXb5RgZSaL63Av<\/p>\n<p>\u2014 Liquid Global Official (@Liquid_Global) <a href=\\\"https:\/\/twitter.com\/Liquid_Global\/status\/1428248815723819012?ref_src=twsrc%5Etfw\\\">August 19, 2021<\/a><\/p><\/blockquote>\n<p> <script async src=\\\"https:\/\/platform.twitter.com\/widgets.js\\\" charset=\\\"utf-8\\\"><\/script><\/p>\n<p>According to CoinDesk, the centralized platform involved was Binance. A representative said they had blocked the accounts linked to the transactions and provided information to Liquid.<\/p>\n<p>Poloniex also confirmed to the publication that it blocked addresses linked to the Liquid hacker.<\/p>\n<p>Earlier in September 2020, the <a href=\"https:\/\/forklog.com\/en\/news\/kucoin-bitcoin-exchange-hacked-losses-estimated-at-150-million\">successful attack on the KuCoin exchange<\/a> happened, and the hacker <a href=\"https:\/\/forklog.com\/en\/news\/kucoin-hacker-sent-5-million-in-ethereum-to-tornado-cash-mixer\">used Tornado Cash<\/a> to conceal traces of stolen Ethereum assets.<\/p>\n<p>Part of the bitcoins was laundered through the <a href=\"https:\/\/forklog.com\/en\/news\/kucoin-stolen-bitcoins-pass-through-chipmixer\">ChipMixer<\/a> mixer and the <a href=\"https:\/\/forklog.com\/en\/news\/kucoin-hacker-began-laundering-bitcoin-through-wasabi-mixer\">Wasabi<\/a> wallet with mixing capability.<\/p>\n<p>Subscribe to ForkLog news on <a href=\\\"https:\/\/vk.com\/forklogcom\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener\\\">VK<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The hacker who breached the Liquid exchange sent Ethereum worth almost $20 million to the Tornado Cash mixer.<\/p>\n","protected":false},"author":1,"featured_media":48164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,888,1256,1314],"class_list":["post-48163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-liquid","tag-privacy-and-personal-data","tag-tornado-cash"],"aioseo_notices":[],"amp_enabled":true,"views":"24","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/48163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=48163"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/48163\/revisions"}],"predecessor-version":[{"id":48165,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/48163\/revisions\/48165"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/48164"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=48163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=48163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=48163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}