Crypto Sleuth Uncovers Complex Tornado Cash Money Laundering Activity

Crypto digital detective ZachXBT discovered a suspicious account that has allegedly been laundering funds via digital asset mixer Tornado Cash and spending the bulk of the assets on the acquisition of Magic The Gathering (MTG) trading cards.

Tornado Cash is the sanction mixer notorious for facilitating money laundering transactions.

Suspected Tornado Cash Laundering Scheme

According to the crypto sleuth, he has been tracking this wallet since the beginning of 2023. The owner of the wallet in question has withdrawn “110 X 100 ETH from Tornado to 11 addresses” and exchanges like Kraken, Bitpay, and Coinbase while leveraging an interesting strategy.

2/ This person has withdrawn 110 X 100 ETH from Tornado to 11 addresses.

After they would:
1) Wrap the ETH
2) Transfer WETH to new address
3) Unwrap the WETH
4) Transfer USDC to MTG broker

(this is a strategy used to trick KYT at exchanges) pic.twitter.com/p8zMOWTiVR

— ZachXBT (@zachxbt) December 7, 2023

First, the wallet owner wraps the withdrawn Ethereum and thereafter, he transfers the wrapped Ethereum (wETH) to a new address. While in this address, the tokens are unwrapped and swapped to United States dollar-pegged stablecoin USDC. Next, the USDC is transferred to the MTG broker. 

Oftentimes, this strategy is used to deceive the Know-Your-Transaction requirements of certain crypto exchanges.

Once he uncovered the strategy, ZachXBT immediately went in search of the MTG broker that received the stablecoin. He found that he had on Instagram the same username as that on the Non-fungible token (NFT) marketplace OpenSea. Then, he approached a few MTG sellers that the broker had interacted with on-chain to get a deeper insight on who he is.

ZachXBT Suspects Uranium Hacker

At this point, the Tornado Cash transactions had gotten quite interesting. It happened to be that the buyer was spending millions on starter decks, alpha sets, and sealed boxes. Also, the broker seems to have hiked the value a little further as it looked like the buyer was overpaying by about 5-10%. 

Another discrepancy that ZachXBT noticed was the fact that the buyer had no idea who the seller was and vice versa, even though the buyer had sent crypto upfront. It was the broker who met with the seller IRL. In the long run, it turned out that the broker had only a little knowledge of crypto. ZachXBT suspects that he may not even be familiar with Tornado Cash and whether the crypto mixer is a favorite tool used by hackers.

The crypto detector thinks that the owner of this wallet may be the Uranium Finance hacker from earlier this year. He is yet to fully confirm his suspicions but he’s convinced he has a thesis that conveniently adds up.