Cryptocurrency analyst ZachXBT has revealed the identity of the suspect in the Bittensor protocol hack, despite the hackers using the Railgun mixer to anonymize transactions.
This is reported by Finway
Uncovering Money Laundering Paths through NFTs and Mixers
In 2024, the Bittensor protocol suffered a massive attack, resulting in the theft of approximately $28 million worth of TAO tokens. The hackers attempted to conceal the movement of funds through instant exchanges, converting them into Monero, and then withdrew about $5 million through the Railgun mixer in the form of Ethereum, USDC, and WETH.
ZachXBT applied his own combination of time and amount heuristics. Thanks to this methodology, he was able to trace the movement of assets even under the anonymity of Railgun. The investigator noted that the use of unique transaction denominations and short time intervals helped establish a connection between the anonymous transfers.
He stated, “Unique denominations and short intervals between transactions provide reliable de-mixing.”
Subsequently, the stolen funds were distributed among three addresses, from which they were used to buy and sell NFTs in anime styles. Such a scheme of fictitious NFT trading is usually not common for laundering cryptocurrency, but this time it allowed the criminals to complicate the tracking of financial flows.
Identifying the Suspect and Next Steps
During the investigation, it was established that one of the addresses is linked to a Bittensor user known as Rusty — the creator of the “Skrtt racing” project, which accepted cryptocurrency bets on toy Hot Wheels races. It later emerged that this individual, referred to in the lawsuit as Ayden B, denied involvement in the hack but confirmed ownership of the wallets involved in the suspicious transactions.
ZachXBT expressed hope that the evidence gathered would help initiate criminal prosecution against the individual in question.