Bitrue Hack Resurfaces as Stolen Crypto Assets Are Moved and Sold One Year Later

In a truly surprising development over a year after the Bitrue crypto exchange hack, analysts of blockchain technology have seen the stolen funds moving around.

The funds—stolen from the crypto exchange Bitrue in April 2023—are supposedly worth in the neighborhood of $23 million. They had largely lain dormant in the hackers’ wallets but are now being moved around and sold. The hacker seems to have moved some of the stolen assets on-chain, apparently in an effort to legitimize the funds. And all this is happening while the hacker is coming back into the public eye.

Stolen Tokens Sold for Ethereum

On-chain activity showed the bad actor sent a lot of stolen tokens—including SHIB (Shiba Inu) and HOT (Holo)—to exchanges and cashed them out for Ethereum (ETH). These transactions included selling 150 billion SHIB for 1,090.4 ETH, worth around $1.97 million at the time. The hacker also sold 135 million HOT, getting 76.5 ETH, which was worth roughly $140,000.

This sale seems to represent the liquidation of the last pieces of the original stash of stolen digital assets. The hack, which took place in April 2023, involved several digital asset thefts, among them Ethereum (ETH), Quant (QNT), Gala (GALA), Shiba Inu (SHIB), Holo (HOT), and Matic (MATIC), with an estimated total worth of $23 million then.

Right after the first hacking, the majority of the hacked tokens were turned into ETH across many decentralized exchanges. The data on the blockchain indicates that this hacker was not in a rush to spend the tokens they stole; in fact, they seem to have held onto several altcoins—like SHIB and HOT—for close to a year before they finally sold them.

ETH Sold, Laundered, and Redistributed

Recent activity isn’t the first movement of the stolen ETH. In March 2024, the hacker offloaded 4,207 ETH for 1,634.5 DAI—at a rate that pegged ETH’s price around $3,885 per coin at the time. This move suggested not just an attempt to extract value, but also to obscure the funds in stablecoins before potential cash-out or redistribution.

After the recent sale of SHIB and HOT, the hacker put 1,050 ETH—which is about $1.9 million—into Tornado Cash. Tornado Cash is a decentralized privacy protocol that’s frequently used in the crypto world to obscure the origin of a transaction and the identity of the sender. Yes, this was an obvious move by the hacker to conceal stolen funds.

Even though there was an effort to make things unclear, a large part of the leftover funds was moved to a new wallet. Blockchain forensics tell us that this wallet now has about 5,111.5 ETH (which is worth about $9.2 million) and a stablecoin called DAI in it—16.345 million DAI, to be exact. DAI is a digital currency that always has the same value as a U.S. dollar. So, in question here is a wallet that has an estimated $25.5 million in assets.

Investigation Ongoing as Hacker Remains at Large

Although the blockchain renders fund transfers visible for all to see, the Bitrue hacker’s identity is still concealed. Using Tornado Cash to obfuscate funds has, in essence, taken advantage of that tool’s capability to make payment trail tracing very, very hard. And it isn’t a tool that just anybody can use: advanced forensic tools are needed to work around the additional layer of privacy that Tornado Cash provides.

A public update about the resurfacing of the stolen funds has yet to be issued by Bitrue. At the time, confidence in the platform had been shaken post-hack in 2023. Although shortly after the breach, the exchange had stated that it would cover the losses for affected users and implement stronger security going forward, confidence has been shaken.

As the cryptocurrency markets keep advancing, incidents such as this one showcase the double-edged characteristic of blockchain transparency. On one side, all transactions are on public display for anyone to see. On the other hand, when it comes to following the money—especially when the mixers are used to obfuscate the trail—blockchain doesn’t offer much help to those trying to maintain the rule of law. That’s a problem.

Currently, the Bitrue hacker has managed to stay ahead of the authorities, using stolen altcoins to create ETH and stablecoins and attempting to cover their tracks through crypto’s digital backroads. It’s unclear whether these tactics will work for them in the long run.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.

Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!