Stolen funds from Bithumb were transferred to Yobit accounts

Most of the stolen funds from this year's Bithumb hack were sent to the Russian exchange Yobit. Crystal Blockchain Analytics analysts came to this conclusion after a thorough study of the data.

To create a more complete picture of leading to the loss of $31 million, including 2,016 BTC, a team of analysts analyzed transactions in the four days leading up to the hack. 

Using a set of blockchain data analysis tools Crystal, we were able to track all the addresses that received funds these days. 

All funds withdrawn from Bithumb wallets for the period from June 16 to June 20 were received by 39 wallets. By June 19, fixed assets were accumulated in one wallet “1LhW”. From it, the main transactions transferred funds to the “18x5” wallet. Analysts noted this address as a cold wallet belonging to the exchange itself; it was this address that received the most funds these days. 

However, from the 19th, the nature of the transfer of funds changed and transactions with a high commission of 0.1 BTC were initiated to two unknown wallets, and then 1,050 BTC were withdrawn and deposited to addresses that had not previously appeared in the blockchain. The withdrawal of funds to these 38 addresses lasted more than a day with an unreasonably high commission, reaching up to 0.2 BTC.

The remaining 38 wallets may belong to hackers and were replenished with 2002.52 BTC. All transactions took place between June 19-20 and provoked a global increase in transaction fees and network congestion.

Based on the information above, analysts believe that there are two possible options:

1) The set of 38 addresses to which funds were seized belongs to hackers.

2) All addresses that were considered belong to the exchange itself Bithumb.

Another possibility is that the theft could have occurred from wallets that are not in the database. Given that Bithumb is cooperating with law enforcement in the investigation of this matter, as well as the fact that they recently went through the licensing process, the likelihood that the exchange will provide false information is unlikely.

On August 2, analysts noted the beginning of the movement of 1973.5 BTC from tracked addresses to two Yobit exchange wallets and from August 31, the transfer of the balance of 29 BTC to the CoinGaming.io service.