Aug 2024 - Bitcoin Whale 4064 BTC Fortune Captured - $237.701m (Global)
"It appears that some of the source funds may be related to Genesis Global Trading" "Notably, the wallet had received 642.4 BTC, worth approximately $37.73 million, from the Genesis Trading Bankruptcy Distributions wallet just two weeks before the breach, while another 2,173 BTC, valued at $127.6 million, had been transferred from Genesis Trading two years earlier."
They had also made transactions promoting memo.sv topic hmwyda, which stands for "How much would you donate anonymously?" and features hundreds of users asking for bitcoin donations for various causes, some of which have been funded.
"While the exact method of the hack remains unclear, experts believe the attackers may have used a combination of phishing, social engineering, and exploiting vulnerabilities in wallet security."
$238,000,000 (4064.37689539 BTC)
$58,483.96 x 4064.37689539 BTC = $237,700,855.77
"According to on-chain investigator ZachXBT, a suspicious transfer was made from a potential victim for 4064 BTC ($238M). The funds were quickly moved to ThorChain, eXch, Kucoin, ChangeNow, Railgun, and Avalanche Bridge. As of August 27th, $505,000 has been recovered."
"After the initial theft, the 4,064 BTC was quickly divided into smaller amounts and transferred across various platforms. This complex series of transactions was designed to make it difficult to trace the funds back to their original source."
"However, when the hackers attempted to use RAILGUN to shield the funds, the effort failed. The stolen Bitcoin did not meet the criteria for privacy within RAILGUN, leading to its unshielding and return, which left the stolen assets exposed rather than protected by the intended privacy protocols."
"Whilst RAILGUN is permissionless and anyone can send tokens in, any tokens that fail to generate a Private POI proof CANNOT enter the privacy set. In this case, the tokens @zachxbt mentioned were unshielded back to the original address and gained no privacy."
"The transaction map further illustrates the movement of a portion of the stolen Bitcoin through the Avalanche Bridge, which likely facilitated cross-chain transfers. This step added another layer of complexity to the hackers’ efforts to obscure the trail.
In addition to using these platforms, the hackers employed mixing services to further complicate the traceability of the funds, effectively combining multiple transactions to mask the origins and destinations of the Bitcoin."
"Per the detailed fund map Xian shared, 3,163.59 BTC originated from three wallets linked to Genesis Global trading. These funds were moved in three transfers of 50 BTC, 1,000 BTC, and 2,113.59 BTC."
"When asked whether the Lazarus Group was responsible for the incident, ZachXBT said “Not this time,” noting that the funds’ movement was “a bit different.”"
Efforts to recover the funds continue.
Further Analysis
A bitcoin whale who was likely involved with Genesis Trading and had previously promoted an anonymous donation group on memo.sv saw their entire fortune of 4064.37689539 BTC wiped out. The funds were quickly distributed across a wide range of protocols including ThorChain, eXch, Kucoin, ChangeNow, Railgun, and Avalanche Bridge. RailGun came out to declare that the thieves had not gained any privacy through their protocol as they had failed the Proof of Innocense model. Some $505k was recovered from swaps conducted through Firn Protocol and NonKYC.io. Firn Protocol closed down their services due to the risk after this incident. Efforts to recover the remaining funds continue.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
Avalanche's Luigi D'Onorio DeMeo Twitter Hacked > > < < Vow Currency Rate Adjustment Exploited
Sources/Further Reading
SlowMist Hacked - SlowMist Zone (Dec 31)
@zachxbt Twitter (Dec 31)
Transaction: 4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090 | Blockchain.com (Dec 31)
@firnprotocol Twitter (Dec 31)
@nonkyc_exchange Twitter (Dec 31)
NonKYC Cryptocurrency Exchange (Dec 31)
@zachxbt Twitter (Dec 31)
@RAILGUN_Project Twitter (Dec 31)
@_ntaff Twitter (Dec 31)
@anytwocardzz Twitter (Dec 31)
Address 1PaYoyzF4G2BasXkA6trg3URgMAZv51BM7 - Bitcoin(BTC) - Professional Data Service for Global Blockchain Enthusiasts (Dec 31)
Memo - Topic - hmwyda (Dec 31)
RAILGUN - On-chain ZK Privacy Ecosystem (Dec 31)
@firnprotocol Twitter (Dec 31)
@RAILGUN_Project Twitter (Dec 31)
Overview | Wiki (Dec 31)
@SearchDecoder Twitter (Dec 31)
@TobyFrei4 Twitter (Dec 31)
@Eemalir Twitter (Dec 31)
@dazai_0x Twitter (Dec 31)
@0xDesigner Twitter (Dec 31)
@HollanderAdam Twitter (Dec 31)
@WazzCrypto Twitter (Dec 31)
@evilcos Twitter (Dec 31)
@OGLemur Twitter (Dec 31)
@Loopifyyy Twitter (Dec 31)
@Duncan30414908 Twitter (Dec 31)
Bitcoin stolen in $238 million breach fails to get privacy shield, returned to original address (Dec 31)
Hacked Bitcoin whale may have lost $238m: ZachXBT (Dec 31)
https://dailycoin.com/zachxbt-flags-238m-bitcoin-transfer-from-a-potential-victim/ (Dec 31)
MistTrack Investigation (Dec 31)
Bitcoin price today, BTC live marketcap, chart, and info | CoinMarketCap (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|