A Bridge Too Far

🕵️Tracking funds from notorious mixer Tornado Cash to an AVAX staking account.

💰In today’s exercise we will take a closer look at funds leaving Tornado Cash and how we are able to track these movements. Tornado Cash has made a few headlines recently since it’s commonly used in the aftermaths of exploits to launder stolen funds, one prominent example being the recent Ronin Bridge exploit (which we have already covered). Before we start: Attributing an outflow of the Tornado Cash mixer to a previous inflow is impossible for an outsider since the Tornado Cash smart contract uses a zero knowledge proof (zk-SNARK) to allow withdrawals based on a previous deposit – the zero knowledge proof only states that Person A (with the correct credentials) has a specific claim against the smart contract, without actually making an explicit reference to a previous deposit. So we’re not saying the transaction as described is in any way attributable to any illicit activity – just a fun exercise, right?🦄

Let’s go: On 14 March 2022, the Tornado Cash wallet transfers 1799 ETH to the Wrapped Ether Contract via another wallet, whereby ETH is deposited into the WETH smart contract and an equal amount of WETH is created (or minted) on the address that sent ETH to the WETH wrapper. The 1799 WETH are then sent to the Avalanche Bridge, which allows not only to move funds from the Ethereum to the Avalanche blockchain, but conveniently also swaps WETH for AVAX (Image 1)

This is where things get a bit complicated: The Avalanche bridge issues WETH tokens on the AVAX address with the identical hash as the address that deposited WETH into the Avalanche bridge. This means that the WETH are now successfully moved from the Ethereum to the Avalanche blockchain. Congratulations! Next step is to swap WETH for AVAX. This is achieved by sending WETH to different so-called routing addresses. These routing addresses swap WETH for AVAX and return AVAX – also via routers – to the initial depositor of WETH. The AVAX are then sent to an external address (Image 2).

To recap: We have wrapped ETH from Tornado Cash into WETH, moved these WETH from the Ethereum to the Avalanche blockchain, and now have super clean AVAX tokens on the Avalanche C-Chain. All good now? NO.

🌠The journey continues

Now that clean AVAX are on the Avalanche C-Chain, the owner exports the funds to the Avalanche X-Chain, and then again exports the funds to the Avalanche P-Chain, which is where we see the final transfer to an Avalanche address, where the AVAX tokens are used for staking (Image 3).

🚩Major implications from our research

We note that AVAX staking is subject to KYC requirements, so one should in theory be able to identify the beneficial owners of the AVAX wallet.
The transfer techniques applied completely evade wallet screening techniques by AML software providers