Wrapped Bitcoin

Merge

when

Tornado

$71 million worth of stolen cryptocurrencies from a recent&nbsp;<a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam" rel="noopener noreferrer nofollow">wallet poisoning scam</a> has been returned to the victim in a fortunate but mysterious turn of events.
The unknown attacker returned $71 million worth of Ether (<a href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow">ETH</a>) tokens on May 12, after the high-profile phishing incident caught the attention of multiple blockchain investigation firms. On-chain security firm Lookonchain unpacked the details in an X <a href="https://twitter.com/lookonchain/status/1789699903041700023" target="_blank" rel="noopener noreferrer nofollow">post</a>&nbsp;on May 13:
<blockquote data-ct-non-breakable="true">
 “SlowMist_Team released a report on this incident 3 days ago, tracking multiple attacker’ IPs possibly from Hong Kong (the use of VPNs has not been ruled out). After that, the attacker replied to the whale and returned all the funds.”
</blockquote>
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-05/3fc222c4-f5a5-41ea-ab33-6e0d5abe887d.jpeg" alt="" title="">
 <figcaption style="text-align: center;">Source: <a href="https://twitter.com/lookonchain/status/1789699903041700023" target="_blank" rel="noopener noreferrer nofollow">Lookonchain</a>
 </figcaption>
</figure>
This comes as a surprising development to the attack from May 3, when an investor <a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam" rel="noopener noreferrer nofollow">sent $71 million worth of Wrapped Bitcoin</a> (WBTC) to a bait wallet address, falling victim to a wallet poisoning scam. The scammer created a wallet address with similar alphanumeric characters and made a small transaction to the victim’s account.
Related: <a href="https://cointelegraph.com/news/el-salvador-bitcoin-treasury-website" rel="noopener noreferrer nofollow">El Salvador launches $360M Bitcoin treasury monitoring website</a>
Like most investors, the victim validated the wallet address by matching the first and last few characters and transferred 97% of their assets to it. However, the difference would have been noticeable in the middle characters, often hidden on platforms to improve visual appeal.
<h2 data-ct-non-breakable="true" id="white-hat-hacker-good-samaritan-or-scared-thief">White hat hacker, good samaritan, or scared thief?</h2>
Despite returning all the stolen funds, on-chain transactions leading up to the event suggest this was not the exploiter’s initial intention.
After receiving the stolen funds, the attacker immediately converted the 1,155 WBTC to approximately 23,000 ETH — a popular move by malicious hackers that can help launder stolen funds via privacy protocols and crypto mixing services such as Tornado Cash.
On May 8, the <a href="https://cointelegraph.com/news/crypto-scam-71m-wallet-impersonation-fund-laundering" rel="noopener noreferrer nofollow">attacker started spreading</a> the funds across over 400 crypto wallets, which ultimately ended up in over 150 separate wallets, before returning the assets.
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-05/aa535711-0d3d-4376-bf00-372f43139020.jpeg" alt="" title="">
 <figcaption style="text-align: center;">Source: <a href="https://twitter.com/PeckShieldAlert/status/1788088248604254639/photo/1" target="_blank" rel="noopener noreferrer nofollow">Peckshield</a>
 </figcaption>
</figure>
The return of the funds came shortly after on-chain security firm <a href="https://twitter.com/SlowMist_Team/status/1788591260409938273" target="_blank" rel="noopener noreferrer nofollow">SlowMist</a> published an analysis on the attacker’s potential Hong Kong-based IPs, suggesting that the thief got scarred by the potential consequences.
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-05/7f0c700d-5f70-4652-8e13-e5bc78a0cfed.png" alt="" title="">
 <figcaption style="text-align: center;">Source: <a href="https://twitter.com/SlowMist_Team/status/1788591260409938273" target="_blank" rel="noopener noreferrer nofollow">SlowMist</a>
 </figcaption>
</figure>
The $71 million theft is only a small part of the phishing attempts associated with the WBTC tief, according to a May 10 incident report by <a href="https://slowmist.medium.com/small-bait-big-fish-unveiling-the-1155-wbtc-phishing-incident-22bf53b6fe60" target="_blank" rel="noopener noreferrer nofollow">SlowMist</a>:
<blockquote>
 “Upon investigating this fee address, we observed that from April 19 to May 3, this address initiated over 20,000 small transactions, distributing small amounts of ETH to various addresses for phishing purposes.”
</blockquote>
The amount of crypto stolen from hacks and scams fell to <a href="https://cointelegraph.com/news/april-25m-exploits-scams-historical-low-certik" rel="noopener noreferrer nofollow">$25.7 million in April</a>, markings the lowest historical figure since 2021 when on-chain intelligence firm CertiK started tracking the data.
Related: <a href="https://cointelegraph.com/news/ethereum-dencun-upgrade-ether-supply-shift" rel="noopener noreferrer nofollow">Ether turns inflationary for the first time since the Merge</a>

WBTC thief returns $71 million worth of stolen funds

Table of Contents

Cointelegraph

Other articles published on May 13, 2024

Bitcoin Enthusiasts Anticipate Powell’s Boost and BTC’s Bullish Leap to $80K+

Ripple CEO Clarifies Tether Comments After A Critical Tweet From Garlinghouse

XRP Price Could Hit Zero, Veteran Trader Peter Brandt Warns

A new roadmap was presented by the Ethena developers.

What’s Happening With Ethereum Price Today: May 13, 2024?

Okta Takes Proactive Measures to Combat Identity-Based Attacks

Join our free newsletter for daily crypto updates!