BonqDAO Exploiter Launders $2 Million Through Tornado Cash

The exploiter responsible for the $120 million attack on BonqDAO has started routing the stolen funds through mixing and swapping services. The Bonq protocol lost millions yesterday following an oracle hack that manipulated the price of the AllianceBlock token (ALBT).

Blockchain security firm PeckShield tweeted earlier today that the exploiter had sent 1 ETH to the popular Ethereum mixer Tornado Cash. The modest transfer is believed to be an attempt to test the laundering of stolen funds, to likely gauge the response of on-chain analysts that watch out for such transactions.

#PeckShieldAlert The BonqDAO exploiter has transferred ~700 $ETH (~$1.17M) to Tornado Cash & swapped ~534k $DAI for ~326 $WETH pic.twitter.com/d4KVmOL6MD

— PeckShieldAlert (@PeckShieldAlert) February 3, 2023

This transfer was followed by a bigger one, precisely 700 ETH worth $1.14 million at the time. After transferring the ETH, the exploiter swapped 534,000 DAI for 326 wrapped Ether (WETH). According to PeckShield, the latest transfer to Tornado Cash was 400 ETH. This brings the total laundered amount to over $2 million.

As per an update by BonqDAO, the exploiter has redeemed over $114,000 worth of crypto in addition to the ALBT. This includes 36,365 DAI, 56,798 USDC, 12.69 WETH, and 298.22 WMATIC. According to blockchain security firm CertiK, the lack of liquidity on the Bonq protocol prevented the exploiter from withdrawing all of the stolen funds.

“We’re looking into how we can compensate the users. As a very young project, we have no treasury which could be deployed. We will come up with an idea to get some of the money back. Don’t expect a full refund though and don’t expect it to be soon,” the protocol told its community on Telegram.

Source