2024

Million

when

Tornado

A person who stole $71 million worth of cryptocurrency from a victim recently returned all the money. This happened after some companies that investigated blockchain noticed what was going on. 
The unidentified attacker gave back $71 million worth of Ether (ETH) tokens on May 12, following a widely publicized phishing incident that drew the focus of several blockchain investigation firms. Lookonchain, an on-chain security firm, provided a detailed analysis in a post on May 13. 
On-chain added, “SlowMist_Team released a report on this incident 3 days ago, tracking multiple attacker’ IPs possibly from Hong Kong (the use of VPNs has not been ruled out). After that, the attacker replied to the whale and returned all the funds.” 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 A whale lost 1,155 <a href="https://twitter.com/search?q=%24WBTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">$WBTC</a>($71M) due to a phishing attack on May 3. A week later, the attacker returned all the funds. How did it happen? What should we pay attention to? 1/🧵 A thread tells you the whole story. <a href="https://t.co/4FVwO631Qo" target="_blank">pic.twitter.com/4FVwO631Qo</a>— Lookonchain (@lookonchain) <a href="https://twitter.com/lookonchain/status/1789699903041700023?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 12, 2024</a>
 </blockquote> 
 </div>
</figure> 
The theft happened on May 3 when someone <a href="https://www.cryptotimes.io/2024/05/03/crypto-scam-alert-68m-wbtc-stolen-in-address-poisoning/" target="_blank" rel="noreferrer noopener">tricked an investor</a> into sending their cryptocurrency to a fake wallet. The scammer made the fake wallet look similar to the real one, but some small differences that were hard to notice.&nbsp; 
The victim didn’t see the differences and sent almost all of their cryptocurrency to the fake wallet. Usually, people check the first and last few characters of a wallet address, but the scammer made sure those matched. 
Although the stolen funds were eventually returned, on-chain transactions before the incident indicate that the exploiter had different initial intentions. Upon receiving the stolen funds, the attacker promptly converted 1,155 WBTC to around 23,000 ETH, a common tactic among malicious hackers to launder funds through privacy protocols and crypto mixing services like Tornado Cash.&nbsp; 
On May 8, the attacker began dispersing the funds among over 400 crypto wallets, eventually distributing them across more than 150 separate wallets before returning the assets. 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#PeckShieldAlert</a> <a href="https://twitter.com/hashtag/Layering?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#Layering</a> The scammer who grabbed ~$71 million worth of <a href="https://twitter.com/search?q=%24WBTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">$WBTC</a> via a poisoning <a href="https://twitter.com/hashtag/scam?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#scam</a> has laundered the stolen funds (~23K <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">$ETH</a>) by sending and spreading them across a large number of wallets. <a href="https://t.co/Blnw5TMT99" target="_blank">https://t.co/Blnw5TMT99</a> <a href="https://t.co/CATCb6t1LL" target="_blank">pic.twitter.com/CATCb6t1LL</a>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1788088248604254639?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 8, 2024</a>
 </blockquote> 
 </div>
</figure> 
Shortly after the return of the funds, on-chain security firm SlowMist published an analysis suggesting that the attacker, potentially based in Hong Kong, became wary of the consequences. The $71 million theft is just a <a href="https://www.cryptotimes.io/2024/05/10/scammer-steals-71m-in-wbtc-and-returns-partial-funds/" target="_blank" rel="noreferrer noopener">fraction of the phishing attempts</a> linked to the WBTC theft, as revealed in a May 10 incident report by SlowMist: 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 🧐After we published an analysis article about the 1155 WBTC phishing incident and a profile of the hacker, it seems like there is a potential turning point in the situation. 3 hours ago, the hacker requested to contact the victim.👀 <a href="https://t.co/ZspG0F7bqW" target="_blank">https://t.co/ZspG0F7bqW</a> <a href="https://t.co/4ZUAGttP5c" target="_blank">pic.twitter.com/4ZUAGttP5c</a>— SlowMist (@SlowMist_Team) <a href="https://twitter.com/SlowMist_Team/status/1788591260409938273?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 9, 2024</a>
 </blockquote> 
 </div>
</figure> 
“Upon investigating this fee address, we observed that from April 19 to May 3, this address initiated over 20,000 small transactions, distributing small amounts of ETH to various addresses for phishing purposes.”

WBTC Thief Returns $71m After Successful Investigation

The Crypto Times

Other articles published on May 13, 2024

Top 5 Gainers Of The Past Week: IPV, TRUMP, TRB, UMA, CEL

Bitcoin Restaking Chain BounceBit Airdrop Now Available Checking Claim Amount

North Korean hackers target crypto firms with ‘Durian’ malware, Kaspersky confirms

US court orders freezing of 279 crypto accounts tied to North Korea

Internet Computer (ICP) Poised For 31% Pump After Price Rebound

New Development in the Tether-XRP Conflict: Ripple CEO Brad Garlinghouse Steps Back

Join our free newsletter for daily crypto updates!