Good day everybody,
Welcome to CryptoGod-1's blog on all things crypto. In this post I will be looking at some recent research done by @ZachXBT in which he analysed a user who withdrew 11,200+ ETH (around $25 million) from Tornado Cash which then seemingly was spent on "Magic The Gathering" trading cards.
$25 million via Tornado Cash to Magic The Gathering
@ZachXBT, the famed blockchain sleuth and investigator, has been busy at it again and this time seems to have uncovered a user spending more than $25 million on "Magic The Gathering" trading cards. Within the post @ZachXBT explains his analysis of A) where the funds really went, and B) where these funds originated from. The thread can be found in the tweet below.
According to his research, the Tornado Cash user (who shall be known as the "buyer") in question is known to have made withdrawals of 100 ETH around 110 times to a total of 11 different wallet addresses. As part of this process the user would first wrap their ETH, then transfer the wrapped ETH (WETH) to a new wallet address. Once in the new wallet the WETH would be unwrapped and transferred to a MTG broker as USDC.
Once the USDC was sent to a Magic The Gathering broker based in the United States which accepted payment in the form of crypto, @ZachXBT was able to find said broker as they made use of the same Instagram username as they did on OpenSea. From there @ZachXBT was in a position to contact some Magic The Gathering sellers who had interacted with the broker, with the brokers address being: 0x80462101b56cb4125c645ff299d3e20c1d908c02
The story developed then as @ZachXBT realised that the Magic The Gathering buyer was spending millions on starter decks, alpha sets, and sealed boxes. From these interactions is was revealed that the buyer was spending over the odds for these packs, roughly by 5-10%. Apparently the buyer would send crypto to the broker before meeting with the seller in real life. The buyer and seller were unknown to each other and that broker apparently had limited crypto knowledge, meaning they were unaware of Tornado Cash and its uses.
The wallets used by the buyer had also sent funds to a variety of deposit addresses at Kraken, Bitpay, and Coinbase. These addresses are:
- 0x34e158883efc81c5d92fde785fba48db738711ee
- 0x3a43ac6baf1fa6bdbc966dbdfe26cf545131898e
- 0x85cb90db50608a950858e023509d6a7fa289e212
- 0xbfe6def287c402114d39d0156e17fda79efff4d2
From there @ZachXBT began to consider where the funds may have originated from. He looked into the top Tornado Cash depositors that were active during the past year, and this was done through a Dune qquery created by @bax1337. The top contributors were:
- Anubis (12400 ETH)
- Cashio (11500 ETH)
- Uranium (11303 ETH)
By making use of timing and multi denomination reveal heuristics @ZachXBT realised that the funds most likely originated from the $50M Uranium Finance hack that happened back in April 2021. This was because Anubis had previously potentially been solved while Casino did not deposit enough ETH to match the withdrawals.
Some of the reasoning given by @ZachXBT for this conclusion was:
4th of October 2022: Uranium hacker deposited 5.01 ETH total to Aztec (privacy tool) at 22:03 UTC into wallet 0xd332be2c39de1f4ecd4ef6ce23ae826906a8a144ebbfefb9cf2a74c7d320f563
5th of October 2022: Two hours later, at 00:15 UTC the same person received 2.7 ETH from Aztec into wallet: 0x2b8745157bd13cb7aa76444af67e7de0bf0b288bff50886b599942a17e0e298c
Come March of 2023 things got very interesting in terms of the movement of cash.
- On both the 6th and 14th of March the Uranium Hacker deposited 52 X 100 ETH into Tornado Cash.
- On both the 7th and 15th of March 2023 the Magic the Gathering buyer received 52 X 100 ETH into their wallet.
- In May of 2023 the Uranium Hacker deposited further funds into Tornado Cash.
At the end of his thread makes it clear that his analysis could be incorrect and this could really just be a coincidence. However, he notes his suspicions due to the fact the buyer:
- spends 8 figures on Magic the Gathering trading cards
- overpays for the trading cards
- makes use of a broker, who likely does not understand Tornado Cash, to shield his identity
- receives $13.2M from Tornado Cash before the indictment by the Office of Foreign Assets Control (OFAC)
- makes use of WETH to obscure source of funds
An interesting case and investigation by @ZachXBT as he shows exactly the process behind the potential source of the funds. Of course if this is crypto used from the Uranium hacker one can only assume the Magic the Gathering cards, but for above market price, will be sold for a standard price in FIAT, thus giving the person clean cash to use. A fascinating scam and methodology of cleaning their ill-gotten cash via the popularity of a trading card game.
Have a great day.
Peace. CryptoGod-1.
Referral Links and Follow Me:
