Axie Infinity Ronin Bridge Hacker Has Already Moved 38293 Eth 114 8 Million

Hackers who stole over $615 million in the Ronin Network exploit have already moved over $114 million worth of Ethereum.

Cover art/illustration via CryptoSlate. Image includes combined content which may include the use of AI tools.

Almost a month ago, Ronin Network, the side-chain built to scale Axie Infinity was exploited by hackers who made off with over $615 million worth of ETH.

The hackers seem to have cashed in 28,164 ETH out of the 173,000 ETH stolen in the Ronin Bridge attack, with a current market value of $86,128,384.73.

The attackers had initially moved over 2000 ETH ($6 million) 2 weeks ago, and now the hackers are on the move again.

The image below, taken from , shows a list of outgoing transactions related to the wallets involved in the exploit.

user ThatGuy222666 has been keeping track of the main wallet since the Ronin Bridge was exploited. It looks like the attackers are using multiple wallets to deposit the ETH into Tornado Cash , a crypto mixer that allows users to disguise their digital trail on the Ethereum blockchain.

According to the image below, it takes the hackers 4-6 hours to empty each new wallet of 100 ETH.

There are outliers, such as this wallet, to which the attacker sent 10,000 ETH over a day ago.

Whoever the exploiter is, the quantity of ETH transferred is constantly increasing.

“The most baffling part of the whole situation to me, is that 327 different wallets have actually sent this person small quantities of ETH in the hope he shares the wealth.” the user said.

user ThatGuy222666 continued to say: “I have never been so intrigued with a random person on the internet, This whole situation blows me away.”

The user finished off by saying:

“I plan on continuing to track where all this ETH goes purely out of curiosity, the absolute magnitude of this exploit is too much for my little brain to comprehend.”

The poster believes that the attack was carried out by a single person who may be moving the funds slowly to avoid detection.

According to the post, the address “was on a US watchlist before the exploit” and was “linked to North Korea.” However the savvy user still believes the attack was carried out by 1-2 users.

CryptoSlate may use AI tools to support research, editing, and production workflows. Published articles remain editorially reviewed by our team. Read our full AI usage disclaimer .

The author of this article is invested and/or has an interest in one or more assets discussed in this post. CryptoSlate does not endorse any project or asset that may be mentioned or linked to in this article. Please take that into consideration when evaluating the content within this article.

Our writers' opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article. Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers .