ZachXBT

Dogecoin

Tornado Cash

Polygon

Tornado

<p class="is-style-lead">Two years ago, AnubisDAO was rug-pulled for about $60 million worth of Ethereum (ETH) and funds were never recovered. However, the blockchain never forgets and block analysts have been keeping an eye on Anubis exploiter wallets.</p> 
<p>New on-chain analysis by ZachXBT may have revealed who the scammers are.</p> 
<h2 class="wp-block-heading" id="deeper-analysis-reveals-possible-identity-of-exploiters">Deeper analysis reveals possible identity of exploiters</h2> 
<p>An analysis done by <a href="https://crypto.news/crypto-investigator-zachxbt-alleges-youtube-influencer-blue-stole-1-5m-through-scams/" rel="noopener noreferrer nofollow">ZachXBT</a>, an on-chain analyst, shows that the funds ended up in two exchange deposit addresses. </p> 
<p>These addresses are 0x51da686c7a2f973ad11fafed6ce9a3ffc020349f, herein marked as (1) and 0x253d7ba533b7d13720fb5ec5a7d1e64d4ff3f58b, herein labeled as (2).</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
   <p lang="en" dir="ltr">1/ Here is my analysis of the $60M Anubis DAO rug pull. <br><br>I noticed a clear trend in 2023 of funds being withdrawn from Tornado Cash and bridged to Polygon before consolidating to two exchange accounts. <a href="https://t.co/UX0uHSG9TN" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/UX0uHSG9TN</a></p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1682047031420829696?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">July 20, 2023</a> 
  </blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
<p>ZachXBT was able to trace a transaction of 95 ETH sent to (1) from bsl.eth, an address owned by <a href="https://twitter.com/beerus" target="_blank" rel="noopener noreferrer nofollow">Beerus</a>. Up until now, the identity of the DAO exploiters had remained unknown. Upon further investigation, wallet (1) belongs to <a href="https://twitter.com/ersan72158565" target="_blank" rel="noopener noreferrer nofollow">Ersan</a>, a friend of Beerus.&nbsp;</p> 
<p>While Beerus’ Twitter account is mainly dormant, having posted last in October 2021, Ersan is quite active, only recently posting on July 20, 2023.</p> 
<p> You might also like: <a href="https://crypto.news/attacker-behind-anubisdao-rug-pull-transfers-another-5-9m-to-tornado-cash/" rel="noopener noreferrer nofollow"> Attacker behind AnubisDAO rug pull transfers another $5.9m to Tornado Cash </a> </p> 
<h2 class="wp-block-heading" id="anubisdao-rug-pull-suspects-laid-low-for-2-years">AnubisDAO rug pull suspects laid low for 2 years</h2> 
<p>In October 2021, following the massive Dogecoin pump, AnubisDAO raised 13,556 ETH from crypto investors. However, just 20 hours after receiving the funds, the ETH was sent to different addresses in a rug pull. </p> 
<p>The result was an immediate loss for investors.</p> 
<p>Two years later, block analysts noticed a trend of the funds (13,556 ETH) getting bridged to Polygon before getting sent to two exchange deposit addresses. These funds were moved through Tornado Cash, a cryptocurrency mixer that completely anonymizes transactions.</p> 
<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"> 
 <div class="wp-block-embed__wrapper"> <iframe title="AnubisDao $60,000,000+ ETH DeFi Rug Pull Overnight!" width="1020" height="574" src="https://www.youtube.com/embed/ijmFYqd30tQ?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe> 
 </div> 
</figure> 
<p>As it turned out, the rug pullers didn’t move funds for over two years only for Peckshield, a blockchain security firm, to be among the first on-chain analytics platforms to pick out funds’ movements.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
   <p lang="en" dir="ltr">It seems the rugged <a href="https://twitter.com/AnubisDAO?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@AnubisDAO</a> funds are being washed via <a href="https://twitter.com/TornadoCash?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@TornadoCash</a> <a href="https://t.co/DPoZ1ifSNX" target="_blank" rel="noopener noreferrer nofollow">https://t.co/DPoZ1ifSNX</a> <a href="https://t.co/LvDSUsL6tS" target="_blank" rel="noopener noreferrer nofollow">https://t.co/LvDSUsL6tS</a> <a href="https://t.co/mKfSdTE6D9" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/mKfSdTE6D9</a></p>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1680475046324883456?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">July 16, 2023</a> 
  </blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
<h2 class="wp-block-heading" id="hackers-may-be-involved-in-other-online-scams">Hackers may be involved in other online scams</h2> 
<p>Further deep-dive reveals that Ersan is a notorious exploiter who “works with multiple ‘suppliers’ for a scam website known as CDGORoll.” </p> 
<p>Warren, another blockchain analyst, links Ersan to high-level and coordinated online casino scams involving shady payment processors and x-rated website hosting services.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
   <p lang="en" dir="ltr">Great finds, Zach.<br><br>Ersan, the owner of the address you mentioned in the 3rd tweet, works with multiple "suppliers" for a scam website known as CSGORoll. The money is laundered through there into some very odd places. This site is a hub for illegal funds. <a href="https://t.co/cdhA8V5WIt" target="_blank" rel="noopener noreferrer nofollow">https://t.co/cdhA8V5WIt</a></p>— Warren (@variancewarren) <a href="https://twitter.com/variancewarren/status/1682048169339916288?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">July 20, 2023</a> 
  </blockquote> 
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
<p>This breakdown comes weeks after PolyNetwork was <a href="https://crypto.news/polynetwork-allegedly-hacked-massive-transactions-detected/" rel="noopener noreferrer nofollow">hacked</a> for millions of dollars. </p> 
<p>Given the size and patience of the AnubisDAO exploiters, investors may have to watch as their investment disappears into the Tornado Cash black hole. </p> 
<p> Read more: <a href="https://crypto.news/polynetwork-allegedly-hacked-massive-transactions-detected/" rel="noopener noreferrer nofollow"> PolyNetwork allegedly hacked, massive transactions detected </a> </p>

Possible identities of AnubisDAO rug pull suspects revealed

Table of Contents

crypto.news

Other articles published on Jul 20, 2023

XRP Bullrun: You Are Missing True Rally

DeFi — Safer than a Bank

ChainGPT Pad — Token Claims and Refund Requests

Price Analysis: Traders Bullish on Ripple and Stellar as XRP and XLM Prices See Steady Rise; Coul...

Palantir Technologies Inc. (PLTR Stock) – New Deal Fuels Rally

A16z Exec Touts Promise of Web3 Social Platforms

Join our free newsletter for daily crypto updates!