Crypto Crooks Sent Over $300M to Bitcoin Mixers in 2023: CertiK Research

Last updated: December 14, 2023 00:52 EST
. 2 min read

Disclosure: Crypto is a high-risk asset class. This article is provided for informational purposes and does not constitute investment advice. By using this website, you agree to our terms and conditions. We may utilise affiliate links within our content, and receive commission.

Following the demise of the popular crypto mixing protocol, Tornado Cash, the Bitcoin ecosystem has become a preferred avenue for discreet fund movement, according to research by blockchain analytics firm CertiK.

In its recent report, CertiK, known for conducting smart contract audits and on-chain monitoring, disclosed that over $300 million has been unlawfully moved through the Bitcoin network.

Providing more details, the platform revealed that 50 of the largest blockchain exploits this year have found their way to the leading blockchain protocol as bad actors seek to navigate increased regulatory scrutiny.

Over $300M in #stolen #crypto assets made their way into Bitcoin mixers in 2023: Data

Data shared by #CertiK showed that a third of the #losses from 50 of the largest #crypto exploits in #2023 ended up in the #Bitcoin #Network. pic.twitter.com/RNlNrwTpnn

— Mystie.Eth (@mystie_eth) December 14, 2023

Crypto hacks have become common in the emerging industry, with the blockchain ecosystem experiencing losses exceeding $1.7 billion in the past year, according to an Immunefi crypto losses report.

In November alone, crypto losses amounted to over $343 million, all attributed to frauds, scams, or platform hacks.

Previously, malicious actors turned to crypto-mixing platforms like Tornado Cash to move illicit gains.

Prior to its sanction, the US Treasury Department’s Office of Foreign Assets Control (OFAC) noted that the Ethereum-based mixing protocol facilitated the movement of over $7 billion.

The Treasury Department also added 40 cryptocurrency wallet addresses to its sanction list.

With Tornado Cash no longer in operation, the anonymity and privacy offered on the Bitcoin network have become attractive to bad actors seeking to evade regulatory sanctions.

Crypto mixing protocols have been adopted by various malicious entities, including the North Korea-backed Lazarus Group.

This practice ensures privacy and makes detection by external parties nearly impossible, as transactions are hidden and only visible to the operators of the two transacting crypto wallet addresses.

Bitcoin Mixers Distinct In Operation

The Lazarus Group has become a significant menace to the crypto ecosystem. The anonymous hackers reportedly stole over 30% of the $685 million crypto losses recorded in Q3, 2023.

30% by Lazarus Group
Screenshot: Immunefi Q3 2023
It is worth noting that the Lazarus group, which stole a staggering $625 million from the Ronin Network (RON) in July 2022, was recently discovered exploiting LinkedIn to target employees of a Spanish aerospace firm.

Hacks were

— Sheikh Naveed (@ShNaveedNafees) October 3, 2023

Despite attempts to disrupt their transaction channels like Tornado Cash and Sinbad, the group has adeptly devised methods to discreetly move funds, mostly leveraging the ingenuity of Bitcoin mixing solutions.

According to CertiK, Bitcoin mixers are inherently different from regular crypto mixing platforms. These mixers enable users to deposit Bitcoin, which is then distributed into smaller units across multiple crypto wallets in fractional amounts.

This makes it more difficult to track and recover the stolen digital assets.

For instance, if 10 BTC assets are stolen from a crypto exchange, instead of being sent as a lump sum to a different wallet address and later withdrawn minus a fee, the assets are fragmented into smaller percentages and forwarded to various crypto wallet addresses.

Blockchain security firms often find tracking this sort of transaction to be herculean, making Bitcoin mixers a high-level money-laundering module.

Nonetheless, Tornado is still reported to be used by cyber threat groups, although only small sums are moved through the crypto mixing platform.

CertiK’s research highlights a concerning trend among malicious actors who exploit the permissionless nature of distributed ledger technology (DLT) to launder illicit funds.

This growing threat to global financial stability and user security has garnered the attention of world leaders.

According to a tweet on X (formerly Twitter) by IBC Group, a trilateral meeting in Seoul, South Korea, has seen the US and Japan partner with the country to launch an initiative in a bid to combat crypto hacks.

🤝Trilateral meeting in Seoul.

US, South Korea, and Japan discuss North Korea’s crypto hacks and WMDs. The condemnation of DPRK’s satellite launch and joint efforts against illegal cryptocurrency use are highlighted.

OFAC sanctions cryptocurrency mixers linked to DPRK hacks. pic.twitter.com/YLM3yl05jS

— IBC Group Official (@ibcgroupio) December 12, 2023

The key focus during the discussion is reportedly North Korea’s use of crypto mixers to move the illicit funds gained from hacking vulnerable blockchain solutions.