ALERT: $32 Million Stolen Ethereum Floods Crypto Market
stolen ether entering the market in calculated portions to prevent drastic exchange rate fluctuations and to minimize attention on the final destinations of the funds. According to Arkham intelligence, the Drift Protocol exploiter's remaining balance was approximately $195.25 million, primarily held in Ethereum. Over the past day, an address identified as Drift Exploiter 5 transferred 13,400 ETH, valued at roughly $32 million, to mixer contracts. Other analytics platforms, including MistTrack, estimate the total daily activity across related wallets to be as high as 25,700 ETH, equivalent to $61.5 million.</p><p>The attackers are employing a classic tactic of controlled obfuscation by sending funds in tranches of exactly 100 ETH. This strategy effectively severs the direct link between the sender and recipient on the public ledger, rendering automatic tracking exceedingly difficult. This current wave of transactions marks the second major laundering attempt; in July, the hackers similarly moved about $44 million through the mixer. Despite these transfers, the bulk of the loot, between 82,000 and 94,000 ETH, worth up to $224 million, remains in the attackers' balances.</p><p>The original heist, which saw assets now dissolving into the shadow sector of DeFi, occurred on April 1, 2024, when the Solana-based exchange Drift Protocol was drained of $285 million in a mere 12 minutes. This incident has been cited in cybersecurity textbooks due to its unprecedented level of preparation and execution. Both TRM Labs and Chainalysis have attributed the sophisticated attack to the North Korean state-sponsored group UNC4736, also known as Citrine Sleet.</p><p>The elaborate scheme unfolded over a six-month period. The hackers meticulously built a flawless alibi by posing as a legitimate venture fund, engaging in personal communications with developers at international conferences, and even depositing $1 million of their own funds into the exchange's pools. Their method of compromise involved exploiting hidden vulnerabilities in Cursor and VSCode to infiltrate the devices of the platform's Security Council members, subsequently intercepting crucial admin keys. The final step involved releasing a fake CarbonVote token, which the attackers then used as fictitious collateral to withdraw real reserves from the protocol.</p><p>For the affected Drift investors, the appearance of their Ethereum in mixers like Tornado Cash signifies a definitive loss of any practical chance of recovering their funds. While law enforcement managed to intercept and freeze approximately $9.2 million in August, the integration of the vast majority of the capital into Tornado Cash renders any further seizure both legally and technically impossible.</p><p>In an effort to salvage its reputation, Drift Protocol launched a compensation program utilizing DFX tokens on October 1. However, the current buyback fund, established with the support of Tether, only covers about 1% of users' net losses. The team aims to replenish this fund with the platform's future revenues, even as the stolen millions are gradually being distributed among new owners on the open market.</p></div>David Isong • Crypto • 5 hours ago • 1 minute read •
The wallets associated with one of this year's most significant crypto heists have been reactivated, signaling a renewed effort by attackers to launder stolen funds. Blockchain trackers Onchain Lens and Lookonchain, using Arkham data, have recorded a mass withdrawal of Ethereum originally pilfered from the decentralized platform Drift Protocol this spring. After two months of inactivity, the perpetrators have begun methodically transferring assets to the Tornado Cash mixer, an anonymity-enhancing service.
This movement involves
Loading...