WazirX Hacker Awakens For First Time Since $235M Hack

The WazirX hacker moved $6.3M ETH to Tornado Cash yesterday. These are the first transactions from any of the hacker’s addresses in 1.5 months since the hack occurred.

The use of Tornado Cash is a significant development. As a decentralized privacy mixer, it is specifically designed to obscure the on-chain trail of transactions, making it a common tool for launderers. This move, after a long period of inactivity, signals the hacker is now actively attempting to break the link between their identity and the stolen funds.

The ETH deposited to Tornado Cash was almost the entire balance of the hacker’s address 0x668 which now has only $153K ETH left over. 0x668 received all of its ETH holdings from two other wallets which sold stolen altcoins for ETH.

As of 3rd September, the WazirX hacker still holds $154.27M in ETH, acquired with funds stolen from WazirX.

This $6.3M transfer, while substantial, represents only a small fraction of the total funds compromised. The fact that the hacker still controls over $154M highlights the immense scale of the security breach. This initial move through Tornado Cash is likely a test or the start of a much longer process to launder the entire haul.

The WazirX hack happened on July 18th and resulted in over $235M of losses for the exchange, which was once India’s largest exchange by volume. 

Arkham’s Balance History Graph credited WazirX holdings as totalling $380M the day prior to the incident, with that number falling to only $148M after the exchange was compromised.