Tracing the Stolen Fund of the Ronin Bridge

About the Ronin Bridge Hack

On March 29th, 2022, Ronin Network released an official announcement to alert the community for the Ronin Bridge security incident. Specifically, the attacker first got the private keys by compromising the Ronin validators, and then withdrew 173,600 ETH and 25,500,000 USDC from the Ronin Bridge through two attack transactions.

Tracing the Stolen Fund

The attacker immediately swap the stolen USDC for ETH after harvesting the profit. Specifically, the stolen USDC were transferred to Uniswap and 1inch, and two intermediate nodes, i.e., 0x6656 and 0xe708, were used to perform the swap back and forth. After the swap, all the stolen fund became ETH.

The flow of transferring the stolen USDC to Uniswap and 1inch.
The flow of transferring the swapped ETH back to the attack address.
The flow of the stolen USDC.

Conclusion

As of this writing, around 175,913 ETH are still held by the attack address, while 1,279 ETH are on the way to be transferred out. We will continuously monitor the trace of the stolen fund, and share our findings with the community in time.

Some Other Data

The attacker has harvested 182,162.86 ETH. Among them, 173,600 ETH were directly stolen from the project, while 8,562.86 ETH come from the stolen USDC.

  • Initial fund: 1.0569 ETH from Binance
  • Stolen ETH: 173,600 ETH
  • Swapped ETH from the stolen USDC: 8,562.86 ETH (4869.18508653411 to Uniswap and 3693.6752093176137 to 1inch)
  • Transferred out: 6,250 ETH

Reference

About BlockSec

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
BlockSec

BlockSec

1K Followers

The BlockSec Team focuses on the security of the blockchain ecosystem and the research of crypto hack monitoring and blocking, smart contract auditing.