Bitrue Drainer Has Awakened After Months of Dormancy, Moving $23M of Stolen Funds Through Tornado Cash

A crypto wallet linked to the $23 million Bitrue exchange hack of April 2023 has resurfaced after months of dormancy, with new on-chain movements showing a calculated

A crypto wallet implicated in the $23 million Bitrue exchange hack back in April 2023 has shown signs of renewed activity after several months of dormancy.

According to data shared by blockchain analyst @EmberCN, the attacker is now actively converting assets into Ethereum (ETH) and routing them through Tornado Cash, a well-known crypto mixer.

This laundering activity marks the latest chapter in a long-running saga that began with the theft of various assets, including ETH, QNT, GALA, and SHIB from the exchange.

"Update: The Bitrue hacker has now used 8,304,000 DAI to buy 3,000 ETH.

Then he has moved 4,600 ETH ($12,645,808) through Tornado. The address now has 8,036,477 DAI and 3,510 ETH."

A Look Back: The Aftermath of the 2023 Hack

To recount, the breach in April 2023 saw the attacker make off with a stash of various assets, including ETH, QNT, GALA, SHIB, HOT, and MATIC. At the time, the collective value of the stolen tokens was pegged at $23 million.

Shortly after the incident, the attacker was spotted systematically converting most of the compromised assets into ETH directly on-chain. The address in question remained largely dormant until March 2024, when it saw a large sale of 4,207 ETH at a market price of $3,885 per coin, generating 16.345 million DAI.

However, even after this substantial liquidity event, the assets remained untouched until June of 2025, when renewed on-chain activity confirmed the movement of both ETH and DAI to a new wallet.

Hacker Converts Stolen Assets and Begins Laundering

The latest observations from analysts reveal that the hacker has been busy once again. The hacker used 8.304 million DAI to purchase 3,000 ETH. Shortly after, 4,600 ETH, which comes to $12.65 million at the time of the transaction, was funnelled through Tornado Cash.

This process of laundering is still in progress, with the address currently holding an additional 8.04 million DAI and 3,510 ETH.

These operations are part of a structured effort to cover up the origins of the funds through Tornado Cash. On-chain records indicate that before initiating these latest transactions, the hacker also sold off remaining SHIB and HOT tokens.

The SHIB liquidation involved a massive 150 billion tokens, which were sold for 1,090.4 ETH at an average price of $1.82 at the time of the transaction, ultimately yielding a value of $1.97 million.

Meanwhile, the sale of 1.35 billion HOT tokens saw an average price of $0.054, generating a total of 76.5 ETH, or roughly $140,000.

The coordinated sale, exchange, and laundering of stolen assets over multiple stages showcases a calculated strategy to exit holdings with minimal traceability. Analysts are continuing to keep an eye on the wallet, which shows signs of ongoing activity.