Stacks

DeFi

Million

Foundation

TRON

Alex Lab, a Bitcoin-based DeFi protocol, revealed new details about the hack it suffered in May. The project announced it had potentially identified the attacker with the help of a blockchain sleuth while the police continued to investigate the incident. 
<h2 id="defi-protocol-loses-millions-to-phishing-attack">DeFi Protocol Loses Millions To Phishing Attack</h2> 
On May 15, the Alex Lab Foundation fell victim to an exploit that took millions in users’ funds. The <a href="https://bitcoinist.com/defi-protocol-uwu-lend-suffers-second-3-7-million-attack-during-reimbursement-process/" target="_blank" rel="noopener ">DeFi protocol</a>&nbsp;unveiled that the attacker obtained private keys via a phishing attack, granting them full access to the funds. 
The attacker used the compromised keys to access one of the vaults associated with the Alex Liquidity Pool, which compromised all assets in the vault. 
The affected asset list includes aBTC, sUSDT, XBTC, xUSD, ALEX, atALEX, LiSTX, SKO, CHAX, $B20, ORDG, ORMM, ORNJ, TRIO, TX20, and STXS. Nonetheless, the project stated that its underlying smart contract code and infrastructure had not been compromised. 
After taking over as the administrator, the attacker drained around 13.7 million Stacks (STX), 3 million of which they sent to several centralized exchanges (CEXs). Per the report, the exploiters sent STX to Binance, Kraken, OKX, Bybit, Kucoin, and other exchanges. 
<img loading="lazy" decoding="async" class="size-large wp-image-307212 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3601.jpeg?w=850&amp;resize=850%2C555" alt="Defi" width="850" height="555" srcset="https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3601.jpeg?w=850&amp;resize=850%2C555 850w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3601.jpeg?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3601.jpeg?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3601.jpeg?w=750 750w" sizes="(max-width: 850px) 100vw, 850px" data-recalc-dims="1"> 
By May 16, the DeFi Project had recovered most of the affected assets. Additionally, it revealed to be monitoring the exploiter’s wallets and to have notified the involved CEXs. 
Alex Lab also stated that a portion of the stolen funds, worth around $4 million, were in the process of being recovered from one of the centralized <a href="https://bitcoinist.com/turkish-exchange-btcturk-falls-victim-to-hack/" target="_blank" rel="noopener ">exchanges</a>. However, the protocol explained that there were no guarantees that all stolen funds could be retrieved. 
<h2 id="lazarus-group-linked-to-the-attack">Lazarus Group Linked To The Attack</h2> 
On June 17, Alex Lab updated investors on the status of the incident. After failing to contact the exploiter, the DeFi protocol continued to track down the stolen assets. 
As a result, the team found that the hacker had broadcasted nearly 10,000 transactions in a month. Per the post, the attacker generated hundreds of new addresses to disperse the on-chain STX tokens. After sending the balance to the new wallets, the tokens were transferred to CEXs in smaller amounts. 
The number of wallets related to the exploit increases exponentially daily “without sign of pause.” Last week, 8.3 million STX, worth around $14 million, had been deposited to CEXs. Meanwhile, approximately 5.5 million STX remained on-chain. 
<img loading="lazy" decoding="async" class="alignnone size-large wp-image-307213" src="https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=813&amp;resize=813%2C660" alt="DeFi" width="813" height="660" srcset="https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=1280 1280w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=517 517w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=813&amp;resize=813%2C660 813w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=750 750w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3603.jpeg?w=1140 1140w" sizes="(max-width: 813px) 100vw, 813px" data-recalc-dims="1"> 
On June 24, Alex Lab <a href="https://x.com/alexlabbtc/status/1805415489717551402?s=61&amp;t=mtZSN0o6iCY-w9O1_1dRoQ" target="_blank" rel="noopener nofollow">detailed</a> crucial new findings in the ongoing investigation. According to the DeFi protocol, they had potentially identified its attackers. 
Seemingly, some of the exploit addresses have been linked back to the North Korean hacking group <a href="https://bitcoinist.com/north-korea-hackers-lazarus-linkedin-crypto-firms/" target="_blank" rel="noopener ">Lazarus Group</a>. The forensic analysis, assisted by crypto detective ZachXBT, revealed “substantial transaction evidence linking the attack to the Lazarus Group.” 
The initial exploit address where the funds were originally sent transferred funds to a second address, which seems connected to the North Korean hacking group. The transaction history shows that the second address “used a known Lazarus TRON address.” 
The Foundation explained they had facilitated contact between the CEXs and the Singapore Police Force. Lastly, they stated they are collaborating with cybersecurity experts to “address the implications of this attack and to recover the lost assets.” 
<img loading="lazy" decoding="async" class="size-large wp-image-307211 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=980&amp;resize=980%2C622" alt="BTC, btcUSDT, DeFi" width="980" height="622" srcset="https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=1484 1484w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=980&amp;resize=980%2C622 980w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=750 750w, https://bitcoinist.com/wp-content/uploads/2024/06/IMG_3605.png?w=1140 1140w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1">

DeFi Protocol Alex Lab $4 Million Hack Linked To Lazarus Group

Table of Contents

Bitcoinist

Other articles published on Jun 26, 2024

Worldcoin Partners with Alchemy to Accelerate World Chain Initiative

'Rich Dad Poor Dad' Author: Hang On Tight As Bitcoin Enters ‘Banana Zone’

Will Solana reach $200 again? Assessing SOL’s next few weeks

Polygon, Sentient, and Eigenlayer Conduct Open AGI Summit to Handle AI Issues

Members of the crypto market’s elite have identified its most lucrative subsector.

BNB Price Struggles as Bullish Momentum Wanes: Can It Overcome Hurdles?

Join our free newsletter for daily crypto updates!