Hackers use MTG cards to siphon funds, here's what happened

An individual spent massive amounts of ETH on Magic the Gathering cards.
This has caused suspicion in the crypto sector about the origins of the funds.

Scams and attacks in the crypto sector have run rampant over the last few years. Hackers have been consistently figuring out how to get away with stolen funds without being found.

Where’s the magic?

Throughout the year, an individual withdrew 11,200+ ETH from Tornado Cash. This person spent it on Magic: The Gathering (MTG) trading cards.

For context, Magic: The Gathering is a popular collectible card game.

Someone took out 110 batches of 100 Ethereum (ETH), splitting them into 11 addresses. Then, they wrapped the ETH, moved wrapped ETH to new addresses, unwrapped it, and sent USDC to an MTG broker.

They did this to trick the checks done by exchanges (KYT) and make it less obvious where the money was going. This process involves a series of steps to confuse tracking and hide the flow of funds.

Identifying the broker involved checking Instagram usernames and reaching out to MTG sellers on-chain.

Notably, the buyer exhibited peculiar behavior, overpaying for MTG items, showing limited crypto knowledge, and transacting through crypto with sellers in person. Funds were also directed to Kraken, Bitpay, and Coinbase.

1/ Throughout this year I have been monitoring someone who has withdrawn 11,200+ ETH ($25M) from Tornado Cash and spent the majority of it on Magic The Gathering (MTG) trading cards.

Here’s my analysis of where the funds went and what the potential source of funds could be.

— ZachXBT (@zachxbt) December 7, 2023

Possible theories

A hypothesis suggests these funds originated from the $50 million Uranium Finance hack in April 2021.

Anubis and Cashio were ruled out as potential sources, leaving Uranium as a viable candidate based on deposits to Tornado and timeline correlation with the hacker’s activities.

The suspicious nature of the individual’s spending, overpayments, and obfuscation methods raise questions about the source and purpose of the funds.

The suspicious behavior could cast suspicion towards the crypto space just as it is about to gain further mainstream popularity due to ETFs.

This kind of behavior may not only impact sentiment around the space but will also affect regulatory scrutiny around the sector.

Realistic or not, here’s ETH’s market cap in BTC terms

ETH sees green

Despite ETH being the primary mode of transfer for the potential attacker, the price of ETH remained unaffected. At press time, ETH was trading at $2,373.91 and grew by 5.05% in the last 24 hours.