Bitfinex Hacker Moving Stolen Bitcoin Again; Evidence of Tumbling/Mixing

The hacker who stole 120k Bitcoin from Hong Kong-based exchange Bitfinex on August 2nd of 2016, has continued moving a portion of their loot across the Bitcoin network this month.

This is the hacker’s first attempt at neutralizing the ability of professional blockchain forensics firms and law enforcement agencies to track the stolen coins.

While the hacker’s first move on Jan. 26, 2017, was Tweeted by Bitfinex and received plenty of coverage from many financial news outlets, maneuvers over the past few days have gone mostly unreported.

For instance, address 1J5fP2e7o5iUNjniSZmjUx8CPLhmatHXBo received a tiny fraction (22.42 BTC) of stolen Bitfinex coins from 5 separate address during the first move on the 26th, but on Jan. 30th, the hacker moved those coins to 13gpVm1CmuqQcaM4oMhvHYBR78WhZ772WJ.

On the same day, the coins were split into two portions and sent to two new addresses, where they remained stationary until February 20th:

For the last two days, these coins have been split into ever-smaller portions and are continuously being distributed & shuffled to an ever-increasing amount of addresses on the Bitcoin network.

Similar patterns have been observed in other Bitcoin addresses holding funds connected to the Bitfinex theft - and there are many!

A post on Pastebin, made by Bitfinex, shows that the hacker diverted the stolen Bitcoin to 2072 different addresses, but only 876 BTC of the 120K were moved during the first action on Jan. 26th.

Curiously, the obfuscation attempt over the last two days coincides with the hype surrounding Bitcoin’s rise above $1100. It’s also worth noting that these crafty maneuvers began right around the time Bitfinex came under a heavy DDoS attack.

At today's exchange rate, the stolen Bitcoin is worth north of $130 million.

Code photo by Yuri Samoilov

Did you find this article informative/helpful? If so, please support Razor-Forex with a small cryptocurrency donation here.