{"id":72206,"date":"2023-01-03T19:02:40","date_gmt":"2023-01-03T17:02:40","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=72206"},"modified":"2025-09-08T13:37:26","modified_gmt":"2025-09-08T10:37:26","slug":"hackers-behind-btc-com-attack-moved-bitcoins-to-tornado-cash-and-binance","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/hackers-behind-btc-com-attack-moved-bitcoins-to-tornado-cash-and-binance\/","title":{"rendered":"Hackers behind BTC.com attack moved bitcoins to Tornado Cash and Binance"},"content":{"rendered":"<p>The hackers who attacked the BTC.com pool of mining company BIT Mining Limited obtained 32.5 BTC and 1,964 ETH. On-chain analysts X-explore arrived at this conclusion.<\/p>\n<p><!--more--><\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/t.co\/lhYe68Nz2l\">https:\/\/t.co\/lhYe68Nz2l<\/a> Cyber Attack On-chain Analysis By X-explore.<br \/>The stolen assests are 32.5 BTC and 1964 ETH. Most of them are transferred to Tornodo Cash, and some are transferred to CEX exchanges Binance and Kucoin.<a href=\"https:\/\/t.co\/RnH4MMOF2q\">https:\/\/t.co\/RnH4MMOF2q<\/a><\/p>\n<p>\u2014 X-explore (@x_explore_eth) <a href=\"https:\/\/twitter.com\/x_explore_eth\/status\/1610221692437270528?ref_src=twsrc%5Etfw\">January 3, 2023<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Most of the coins were transferred to <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-tornado-cash-mixer-and-why-was-it-sanctioned\">Tornado Cash<\/a>, but some funds went to centralized exchanges Binance and Kucoin.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">12\/03\/2022 03:31<br \/>BTC wallet 3FxUA8godrRmxgUaPv71b3XCUxcoCLtUx2 transferred 32.5 BTC (~$0.55M), suspected to be stolen. <br \/>Attackers suspected of using ceentralized BTC Mixer for Money Laundering<\/p>\n<p>2\/3 <a href=\"https:\/\/t.co\/09D5kLjRRm\">pic.twitter.com\/09D5kLjRRm<\/a><\/p>\n<p>\u2014 X-explore (@x_explore_eth) <a href=\"https:\/\/twitter.com\/x_explore_eth\/status\/1610222565154512896?ref_src=twsrc%5Etfw\">January 3, 2023<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cThe Bitcoin wallet 3FxUA8godrRmxgUaPv71b3XCUxcoCLtUx2 transferred the stolen 32.5 BTC (~$0.55 million). The attackers are suspected of using a mixing service to launder money,\u201d the researchers noted.<\/p>\n<\/blockquote>\n<p>In their observations, the hacker also transferred 1,964 ETH to four new addresses. The funds subsequently flowed to Tornado Cash, and then to exchanges such as Binance.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">12\/02\/2022 16:23 <br \/>ETH wallet 0x5b310960a7922092fdCB9295ece336012F9CF87e<br \/>A total of 1,964 ETH (~$2.50M) was deposited to four new addresses and subsequently flowed to <a href=\"https:\/\/t.co\/sIv5Z0LX0T\">https:\/\/t.co\/sIv5Z0LX0T<\/a> and Exchanges such as Binance.<\/p>\n<p>3\/3 <a href=\"https:\/\/t.co\/5j0oSzH5mU\">pic.twitter.com\/5j0oSzH5mU<\/a><\/p>\n<p>\u2014 X-explore (@x_explore_eth) <a href=\"https:\/\/twitter.com\/x_explore_eth\/status\/1610222889919447044?ref_src=twsrc%5Etfw\">January 3, 2023<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Earlier, the BTC.com <a href=\"https:\/\/forklog.com\/en\/news\/bit-minings-btc-com-mining-pool-hit-by-a-3-million-cyberattack\">attack took place on December 3<\/a>. <\/p>\n<p>Representatives of BIT Mining Limited said they reported the incident to the Shenzhen authorities (China). On December 23, authorities began an investigation.<\/p>\n<p>Read ForkLog\u2019s Bitcoin news in our <a href=\"https:\/\/telegram.me\/forklog\" target=\"_blank\" rel=\"nofollow noopener\">Telegram<\/a> \u2014 news on cryptocurrencies, prices and analytics.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The hackers who attacked the BTC.com pool of mining company BIT Mining Limited obtained 32.5 BTC and 1,964 ETH.<\/p>\n","protected":false},"author":1,"featured_media":72207,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1713,856,1154],"class_list":["post-72206","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-bit-mining-limited","tag-btc-com","tag-crimes"],"aioseo_notices":[],"amp_enabled":true,"views":"26","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/72206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=72206"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/72206\/revisions"}],"predecessor-version":[{"id":72208,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/72206\/revisions\/72208"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/72207"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=72206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=72206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=72206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}