The individual responsible for the $25 million Kronos Research hack has now moved an additional $2.6 million worth of Ether to the cryptocurrency mixing service Tornado Cash. This transfer, which involved 700 Ether, took place on May 21 from the Kronos exploiter wallet “0x3,” as reported by on-chain security firm PeckShield.
On May 20, the exploiter sent three transactions, each worth 100 Ether. Today, they made seven more transactions of 100 ETH each, bringing the total to 1,000 Ether, which is equivalent to over $3.7 million at the current price. After this transfer, the wallet still holds a little over 60 ETH, worth more than $223,000. On May 19, the peak value of the hacker’s wallet was over $6.4 million, according to CoinStats data.
The decision to launder the funds is likely due to the rapid price surge of Ether. In the past 24 hours, Ether’s price has risen over 20% to trade at $3,744 as of 11:14 am UTC. The last time Ether traded above $3,700 was on March 15, according to CoinMarketCap.
This Ether rally comes after reports that the United States Securities and Exchange Commission (SEC) has reversed its stance on spot Ether ETFs, possibly due to political pressure. It has reportedly asked ETF exchanges to update their 19b-4 filings. Senior Bloomberg ETF analyst Eric Balchunas has increased the odds of approval to 75% from the previous 25%, further boosting investor sentiment.
Crypto mixing protocols like Tornado Cash are used to obscure the trail of crypto transactions, making it difficult to trace the source of funds. Exploiters often utilize these services when laundering crypto obtained through illicit activities. The Kronos Research hacker had not moved funds since May 7 when they transferred 1,314 Ether, worth over $4 million, to the same crypto mixing service.
Kronos Capital was exploited in November 2023 when the hackers gained access to the firm’s application programming interface keys. Initially, the firm denied any loss of funds but later, it was revealed that approximately 12,800 ETH, worth $25 million, had been stolen and transferred to six different crypto wallet addresses. Kronos Capital paused its trading services to investigate the incident.