Ethereum

April

Arkham

Tornado Cash

Shiba Inu

The Rain cryptocurrency exchange was “likely exploited” on April 29 when $14.1 million worth of Bitcoin (<a href="https://cointelegraph.com/bitcoin-price">BTC</a>), Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>), Solana (<a href="https://cointelegraph.com/solana-price-index">SOL</a>), and <a href="https://cointelegraph.com/xrp-price-index">XRP</a> was transferred to a new wallet under suspicious circumstances, according to a May 13 report from on-chain sleuth ZachXBT. The report comes two weeks after the reportedly suspicious transactions took place.
Rain is a centralized crypto exchange headquartered in Bahrain. It specializes in serving customers from Southwest Asia and the Middle East. According to regional news site The National, Rain has <a href="https://www.thenationalnews.com/business/technology/2021/06/28/trading-volumes-in-bahrains-cryptocurrency-platform-rain-cross-1bn-mark/" target="_blank" rel="noopener nofollow">recorded</a> over $1 billion in trading volume since its inception.
ZachXBT’s official Telegram channel reported that the transferred funds “were quickly transferred to instant exchanges and swapped for BTC and ETH” before being deposited to two destination addresses on the Bitcoin and Ethereum networks. The Ethereum address, which ends in 6c28, is currently <a href="https://etherscan.io/address/0x197bc094f990261fd6841342901c451858756c28" target="_blank" rel="noopener nofollow">holding</a> approximately 1,881 ETH, worth $5.5 million at the current price. The Bitcoin address, which ends in prp2, is <a href="https://mempool.space/address/bc1q53aawrkpt5lvk2e30z36unvmhqqdru7q4rprp2" target="_blank" rel="noopener nofollow">holding</a> ‎137.9 BTC, worth $8.6 million at the current price.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-05/8e417d36-0387-4156-bf87-4cf120f26853.png">
 <figcaption style="text-align: center;">
 Report on suspected Rain exploit. Source: <a href="https://t.me/investigations/122" target="_blank" rel="noopener nofollow">ZachXBT</a>, Telegram.
 </figcaption>
</figure>
According to Arkham Intelligence data, the Ethereum destination address received its funds from an address ending in d609. The d609 address, in turn, received the funds from several Bitgo multisignature wallets. Arkham has not explicitly labeled these wallets as belonging to Rain.
On April 29, these Bitgo wallets posted 26 separate transactions, sending ETH and a variety of tokens to the address ending in d609. More than 590 ETH ($1.7 million at the current price) was sent, as well as approximately 20 billion Shiba Inu ($481,000),12,500 Chainlink ($169,000), $240,000 Tether (<a href="https://cointelegraph.com/tether-price-index">USDT</a>), and $500,000 USD Coin (<a href="https://cointelegraph.com/usdc-price-index">USDC</a>).
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-05/3a001b4a-9edb-49f8-a4a9-62b3c36c5732.png">
 <figcaption style="text-align: center;">
 BitGo wallets suspicious outflows. Source: Arkham Intelligence.
 </figcaption>
</figure>
These tokens were immediately swapped for ETH on Uniswap. As these swaps were being carried out, the account continued to receive more tokens from the Bitgo wallets, including Aave (AAVE), Yearn Finance (YFI), MakerDAO (MKR), and other tokens.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-05/9e9db7f2-e5d7-4ed5-917f-4f22705057d5.png">
 <figcaption style="text-align: center;">
 Reported Rain exploit transfers and swaps. Source: Arkham Intelligence.
 </figcaption>
</figure>
The account also received funds from a Binance hot wallet.
Cointelegraph contacted Rain for comment but did not receive a response by the time of publication.
Hacks and exploits continue to pose a risk for crypto users. On May 6, Gnus.AI lost more than $1.27 million when its Discord server <a href="https://cointelegraph.com/news/gnus-discord-hack-causes-1-27-million-losses">became compromised</a> and a private key was leaked. On May 13, cybersecurity firm Kaspersky reported that the North Korean hacker organization Kimsuky has launched a new “Durian” malware that <a href="https://cointelegraph.com/news/north-korean-hackers-deploy-durian-malware-targeting-south-korean-crypto-firms">specifically targets crypto firms</a>.
Related: <a href="https://cointelegraph.com/news/kronos-research-hacker-funds-tornado-cash-exploit">Kronos Research hacker shifts funds to Tornado Cash</a>

Rain exchange suffered $14.1M in suspicious outflows 2 weeks ago — ZachXBT

Cointelegraph

Other articles published on May 13, 2024

Solana and Ethereum Struggle to Recover, Furrever Token Offers $20,000 Competition to Lift Spirits

Ripple’s XRP Experiences Dips Despite Legal Developments: An Analysis

Toncoin Price Prediction: TON Poised to Break Past All-Time High Amid TVL Growth

Mark Cuban Urges CFTC Regulation of Crypto and Suggests Impact on 2024 Election

Ethereum’s Ether Supply Turns Inflationary for First Time Since Merge After Dencun Upgrade

Notcoin Exchange Deposits Ending Tomorrow! Withdrawals Resume Post-Listing!

Join our free newsletter for daily crypto updates!