Rain exchange attacker address starts laundering ETH through Tornado Cash

The hacker behind the recent attack on the Rain crypto exchange has begun laundering stolen Ether through Tornado Cash, a popular mixing service. Blockchain security firm PeckShield, which has been closely monitoring the situation, flagged this move.

PeckShield’s latest update reveals that the attacker transferred 1,155 Ether (ETH), worth approximately $2.9 million, to Tornado Cash. This transaction appears to be part of a larger effort to obscure the origins of the funds and make them more difficult to trace.

The Rain exchange breach

The Rain cryptocurrency exchange, based in Bahrain and specializing in serving clients from Southwest Asia and the Middle East, was exploited on April 29. During this breach, approximately $14.1 million worth of various cryptocurrencies, including Bitcoin (BTC), Ether, Solana (SOL), and XRP (XRP), were transferred to a new wallet under suspicious circumstances.

Onchain sleuth ZachXBT first reported the exploit on May 13, detailing the suspicious transactions that had taken place two weeks prior. The report shed light on the scale and method of the attack, raising alarms within the crypto community.

AJ Nelson, co-founder of Rain, confirmed the breach on the social media platform X. In his statement, Nelson assured users that the exchange had covered the stolen assets from its funds, ensuring that the platform continues operating normally.

This swift response aimed to maintain user trust and demonstrate the exchange’s commitment to security and transparency.

The role of Tornado Cash

Tornado Cash is a decentralized, non-custodial privacy solution built on Ethereum. It uses zero-knowledge proofs to enable users to break the onchain link between the source and destination of funds.

While this technology is valuable for privacy-conscious users, malicious actors have also exploited it to launder stolen cryptocurrencies.

In this case, the Rain hacker’s use of Tornado Cash underscores the challenges faced by exchanges and law enforcement agencies in tracking and recovering stolen assets.

The mixer service makes it significantly more difficult to trace the flow of funds, posing a significant hurdle in the pursuit of cybercriminals.

While the funds from Rain’s hack are being laundered, the Nexera protocol has been exploited to steal $1.5 million worth of digital assets in another smart contract security incident.

However, a suspected white hat hacker exploited a vulnerability in the Ronin Network, making off with $9.8 million in ETH tokens, but then returned the funds in a surprising move on Aug. 6.