Orbit Chain Hacker Moves $48 Million To Tornado Cash After Months Of Inactivity

As an analyst with several years of experience in blockchain security and cryptocurrency fraud investigations, I find the recent activity of the Orbit Chain hacker both intriguing and concerning. The movement of over $48 million from the exploit to Tornado Cash for laundering raises questions about the hacker’s intentions and their level of sophistication.


A cybercriminal responsible for the $82 million Orbit Chain breach has transferred approximately $48 million of the stolen funds to the cryptocurrency tumbler, Tornado Cash, with the intention of laundering the ill-gotten gains.

On New Year’s Eve, Orbit Chain suffered from one of the largest hacks in the year, resulting in the seizure of funds that have been inactive for more than five months.

Orbit Chain Hacker Moves Funds

As a crypto investor following the recent developments closely, I can tell you that after months of no activity whatsoever, the hacker suddenly moved the stolen 12,932 ETH, approximately equal to $47.7 million at current rates, in seven transactions on June 8th. These transactions were traced by Arkham Intelligence to a new address. Subsequently, this new address was utilized to transfer the ill-gotten gains to Tornado Cash, a well-known cryptocurrency mixer.

Arkham, which was the first to spot the transfer, stated in a post on X, 

As a crypto investor following the latest developments, I’m keeping an eye on the ongoing situation with the Orbit Chain Exploiter. Five months after stealing over $100 million in Ethereum (ETH) and other cryptocurrencies like DAI and USDT from Orbit Chain, this elusive hacker has resurfaced. In the past hour, they moved 8671 ETH ($32 million) to a new address and are now attempting to deposit it into Tornado Cash. This anonymous transaction mixing service is known for its privacy features, making it difficult to trace the source or destination of funds. The Orbit Chain Exploiter initially stole over $100 million worth of assets back in [previous time frame], and they still hold a substantial amount, with over $66 million in ETH and over $20 million each in DAI and USDT remaining in their possession.

Other Assets Remain Untouched

As an analyst, I’ve examined the data from EtherScan, and I can confirm that approximately $47.7 million was transferred in batches of 100 ETH through a cryptocurrency mixer. However, it is important to note that the hacker has not yet moved around $20 million worth of stolen DAI tokens and other unspecified coins from the exploit. The current balance of the hacker’s wallet amounts to roughly $71.2 million. This sum comprises $51.1 million in ETH, along with minor holdings of wrapped Ethereum (wETH), wrapped Bitcoin (wBTC), USD Coin (USDC), and Orbit Chain (ORC).

The Orbit Chain Hack And Growing Exploits

In the closing hours of December 31, 2023, approximately at 8:52 PM UTC, Orbit Chain suffered an exploit. This unfortunate event was not publicly acknowledged by Orbit Chain until the following day. During this time, they were collaborating with international law enforcement to gather information and apprehend the perpetrator. They also encouraged users to come forward with any relevant intelligence in exchange for a reward.

“We’re working closely with law enforcement agencies around the world. Anyone supplying crucial information that helps us identify the perpetrator or retrieve stolen property will be rewarded with a bounty.”

In the Cosmos network, Orbit Chain adopts the Inter-Blockchain Communication (IBC) protocol. As reported by DeFiLlama, its TVL (Total Value Locked) currently stands at $37 million, a noticeable decrease from the prior $149 million following an attack. The menace of hackers has escalated in 2024, with approximately $542 million worth of cryptocurrency being taken during the initial quarter alone. This represents a substantial 42% rise compared to the same timeframe in the preceding year.

Read More

2024-06-12 19:08