2024

Prisma Finance

ZachXBT

Tornado Cash

<p class="is-style-lead">Crypto detective ZachXBT has identified the alleged PrismaFi hacker, exposing their involvement in the $11.1 million theft and subsequent demands.</p>
<p>Blockchain sleuth ZachXBT uncovered an alleged attacker behind the PrismaFi hack, which left the protocol without $11.1 million worth of crypto. In a <a href="https://x.com/zachxbt/status/1780244613808160958" target="_blank" rel="noopener noreferrer nofollow">series of X posts</a>, ZachXBT revealed that the exploiter, known as 0x77 (or Trung) might be linked to multiple other exploits.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">1/ An investigation into the alleged $11.1M <a href="https://twitter.com/PrismaFi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@PrismaFi</a> exploiter 0x77 (Trung) and the multiple other exploits they are connected to. <a href="https://t.co/QU1Oy7Txbb" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/QU1Oy7Txbb</a></p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1780244613808160958?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">April 16, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>The Prisma team detected a series of transactions on the MigrateTroveZap contract earlier in March, which eventually <a href="https://crypto.news/prisma-finance-hack-stablecoin/" target="_blank" rel="noopener noreferrer nofollow">resulted in a loss</a> of 3,257 ETH (equivalent to $11.1 million at the time). Initially, the attacker communicated with the Prisma deployer, claiming the attack was just a whitehat initiative. However, all the funds were later <a href="https://crypto.news/prisma-finance-hacker-tornado-cash/" target="_blank" rel="noopener noreferrer nofollow">deposited</a> to Tornado Cash, a sanctioned crypto mixer.</p>
<p>You might also like: <a href="https://crypto.news/prisma-finance-hacker-demands-apology-after-11m-breach/" rel="noopener noreferrer nofollow"> Prisma Finance hacker demands live conference, apology after $11m breach </a></p>
<p>The exploiter proceeded to make audacious demands, including a $3.8 million (34%) whitehat bounty, significantly higher than the industry standard of 10%, ZachXBT noted, adding that the demand was “essentially extorting the team as the treasury does not have sufficient assets to reimburse users.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">3/ At first the attacker communicated with the Prisma deployer the attack was whitehat.<br><br>Later that day all of the funds were deposited to Tornado Cash contradicting that statement. <br><br>The exploiter began making outrageous demands and asked for a $3.8M (34%) whitehat bounty <br><br>This… <a href="https://t.co/vFdJCJM5mz" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/vFdJCJM5mz</a></p>— ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1780244625992692072?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">April 16, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Further investigation revealed that the exploiter’s address received funds via FixedFloat and was subsequently located on Arbitrum, a layer-2 solution on Ethereum. By analyzing timing, ZachXBT found that the exploiter’s address was connected to withdrawals on TRON, including those from the <a href="https://crypto.news/tag/bybit/" target="_blank" rel="noopener noreferrer nofollow">Bybit</a> crypto exchange.</p>
<p>The investigation also uncovered connections to previous exploits, such as the Arcade_xyz exploit from March 2023 and the Pine Protocol exploit from February this year. The exploiter, using the alias 0x77 on Telegram, remained active, with ties to the deployer of @modulusprotocol, further solidifying the link between each incident.</p>
<p>The investigator also disclosed conducting an analysis of the exploiter’s personal information, gathering phone numbers and emails, which suggested a proficient technical background. Currently, all gathered personal data has been forwarded to the Prisma team, who are pursuing legal action against the hacker in Vietnam and Australia, ZachXBT added.</p>
<p>Read more: <a href="https://crypto.news/fixedfloat-reportedly-suffers-another-exploit-losing-2-8m/" rel="noopener noreferrer nofollow"> FixedFloat reportedly suffers another exploit, losing $2.8m </a></p>

Blockchain sleuth uncovers identity of PrismaFi’s hacker, who stole $11m

crypto.news

Other articles published on Apr 17, 2024

Exploring the Impact of Fan Tokens on Football and Crypto Markets

Key Developments in the Cryptocurrency Market

Emerging Trends in Turkey’s Cryptocurrency Exchanges

Chainlink (LINK) MVRV Ratio Drops Massively, Top Analyst Highlights Buy Signal

This Is How Nearly 1 Billion Polygon (MATIC) Will Witness Profits

Crypto Whale Loses $4,500,000 Attempting To Leverage Long Ethereum (ETH) Twice: Lookonchain

Join our free newsletter for daily crypto updates!