# Inside the Balancer Exploit: A Comprehensive Forensic Review

## Summary [On November 3, 2025 Balancer V2’s Composable Stable Pools were exploited](https://x.com/Balancer/status/1985392731200409993?s=20) via a precision/rounding flaw in pool math, enabling abnormal withdrawals and rapid multi-chain drains. Estimated losses total **\~$129M** across multiple EVM and Layer-1 networks. [**Balancer**](https://balancer.fi/) is a multi-chain automated market maker and one of the leading DEXs in crypto. Shortly after the incident, the team acknowledged the exploit, clarified that it impacted **V2 Composable Stable Pools only** (not V3), and began a coordinated response and guidance on X. According to Balancer’s initial communications, [Hypernative’s monitoring system was among the first to flag the exploit.](https://x.com/Balancer/status/1986104426667401241?s=20)

While the broader ecosystem was in distress, some networks, such as [**Berachain** and **Sonic** took temporary measures](https://www.coindesk.com/markets/2025/11/03/berachain-halts-network-to-contain-balancer-linked-exploit-to-conduct-emergency-hard-fork) to throttle or freeze the exploiter’s activity to aid recovery. Security researchers and data platforms, including [Blockscope](https://x.com/BlockscopeCo/status/1985300581439721811?s=20), PeckShield, Cyvers, and Nansen flagged large outflows and sized early losses; major outlets (e.g.,Bloomberg, Decrypt) amplified the scope within hours.

Interestingly, [Balancer reports undergoing extensive security review of its V2 contracts](https://finance.yahoo.com/news/balancer-suffers-128m-smart-contract-142655037.html), and its website lists audits by firms such as OpenZeppelin, Trail of Bits, Certora, and ABDK. Separately, monitoring company [Webacy](https://www.webacy.com/) publicly claimed that its systems had identified the underlying issue prior to the incident, an after, the-fact claim that was met with skepticism by parts of the crypto community.

## Decoding the Exploit The exploit in Balancer V2’s Composable Stable Pools originated from a **rounding-direction flaw** in the pool’s math logic, specifically during `EXACT_OUT` swaps. This subtle bug caused the protocol to round down user inputs instead of rounding up, meaning the pool consistently under-charged traders for withdrawals. Over thousands of rapid swaps, this small precision bias compounded into a large financial drain.

Using the Contract Usage tool, we visualized the volume of events and transfers occurring across various pool and vault contracts; This graph shows total events chart for one of the affected pools on Arbitrum.

In Balancer’s Composable Stable Pools, the system maintains a mathematical invariant (denoted D; Think of invariant like the total weight or product of the pool) that ensures fair pricing between all tokens in the pool. These pools can also trade their own pool token (BPT) as if it were a regular asset alongside the underlying tokens. Because Ethereum’s EVM only supports integers, Balancer “scales” token values to a common 18-decimal format before calculations, which introduces rounding at each step. Normally, such rounding is negligible. However, in this case: 1. The attacker selected a pool containing three tokens: Token A, Token B, and the POOL token (BPT) itself. 2. They swapped large amounts of the POOL token for A and B, leaving A and B balances extremely small, while the POOL balance became huge. 3. Next, they performed `EXACT_OUT` swaps in the opposite direction (A and B → POOL). When calculating how much A or B to send, the pool’s math (in the BPT swap path) first upscaled balances and amounts with round-down semantics, which became significant at dust-level balances (While BPT is intentionally excluded from the invariant; that part is by design). 4. As a result, the contract computed a much smaller “amountIn” than it should have, allowing the attacker to withdraw a large amount of POOL tokens while paying very little in return. By chaining these steps in batchSwap operations, the attacker could artificially deflate the pool invariant (D), lowering the BPT price and extracting value repeatedly within a single transaction. Over multiple iterations, these precision losses accumulated into a massive drain across multiple chains.

Critical upscaling step in the function`_swapWithBpt` that enabled the `EXACT_OUT` under-charged

AI Investigator clarifies the swap sequence, highlighting the exploit txs' core mechanics

In plain terms, the pool thought it was charging enough for each swap, but due to rounding errors and the exclusion of the POOL token from its calculations, it was actually selling its assets too cheaply. The attacker exploited this mispricing loop again and again until the pool’s reserves were drained. Using Blockscope’s AI Investigator, we can view the exploit transaction in a simplified way. Below, AI Investigator details the token movements in this complex exploit, showing the Vault transferring out assets such as wETH, osETH, wstETH, and BPT to a fresh address, exactly matching the expected under-charge pattern. Similar traces appeared on other affected networks, confirming a systematic, multi-chain execution.

AI Investigator summary of token inflows and outflows between the Balancer Vault and the exploiter involving multiple transfers

## On-Chain Activity The exploiter executed near-simultaneous, multi-chain setup and drains across Ethereum, L2s, and other major networks. Unlike multisig takeovers, this incident hinged on the `EXACT_OUT` rounding bug in Balancer V2 Composable Stable Pools. Exploiter's wallets were pre-funded, approvals primed, and identical swap loops launched on each network within minutes of one another. **Tracer 1** shows the exploit initiation on Ethereum: funds move from Tornado Cash to a staging EOA, which immediately fans out gas-sized top-up to a fresh intermediary, which eventually bridges to target networks, and seed per-chain executor wallets. The tight, synchronized timing indicates a coordinated multi-chain playbook rather than opportunistic movement.

Once the exploit begins, the attacker drains the Balancer Pools, which emits multi-asset outflows to exploiter addresses via the vault. Proceeds are locally consolidated before the next loop. The same pattern—approve → `EXACT_OUT` loops → Vault outflows → local consolidation, appears on other networks covered in this report. **Tracer 2** illustrates this on the Arbitrum network.

\ With per-chain extractions complete, the majority of proceeds are bridged back to Ethereum for deeper liquidity and broader off-ramps. **Tracer 3** shows converging flows of ETH from major L2s and from networks like Sonic and Berachain to Ethereum mainnet.

## Breakdown & Timeline ### November 2, 2025 at 05:35 UTC The exploit initiates on Ethereum, when primary exploiter `0x86fedad11c4765700934639f1efe1fc01355c982` receives funds from Tornado Cash. Tx. hash: `0xca2556343293eebe2d3d2a81a1dd94e1457c0c07340270ff8768f507193fff21`

Exploiter getting initial funds from Tornado Cash

Moments later, they seed an intermediary `0x766a892f8ba102556c8537d02fca0ff4cacfc492` with \~$15k worth of ETH to stage gas and initial liquidity.

### November 2, 2025 at 06:28 UTC Exploiter `0x766…c492` begins bridging to Arbitrum and Gnosis, kicking off a multi-network funding pattern. Using Gas.Zip and relay services, additional destinations & intermediaries were pre-funded to enable near-simultaneous execution across chains.

Transactions showing `0x766…c492` bridging funds

### November 3, 2025 at 07:50 UTC To illustrate this multi-network and complex exploit, we will focus on **Arbitrum**, where approximately **$6.3 million** in losses were recorded in total. The main exploits started on November 3 with Exploiter `0x506d1f9efe24f0d47853adca907eb8d89ae03207` deploying a contract to run the exploit. It then executes the `EXACT_OUT` rounding-bias sequence against Balancer’s Composable Stable Pools, causing the Balancer Vault to undercharge and emit multi-asset outflows (notably wETH, liquid-staking tokens, and affected BPTs). Proceeds consolidate to a specified address, here`0x872757006b6f2fd65244c0a2a5fdd1f70a7780f4`. One of the transactions: `0x4e5be713d986bcf4afb2ba7362525622acf9c95310bd77cd5911e7ef12d871a9`

Token transfers involved in the transaction.

On **November 9**, address `0x8727…` executed a series of swaps, consolidating profits into approximately 1,830.46 ETH (\~$6.23M). These funds were subsequently transferred to `0x506d…` and bridged back to Ethereum via Stargate, distributed across multiple transactions.

Funds getting bridged from Arbitrum to Etherum

The same exploit pattern repeats across Base, Optimism, Polygon, Sonic, Berachain, Gnosis, and others. Proceeds are progressively bridged to Ethereum mainnet using several bridges. \~$90M currently resides on Ethereum, with smaller residuals & frozen funds scattered across L2s/other networks. ## Post-Incident Developments 1. **Balancer’s response:** Using Blockscope’s Transaction Decoder, we inspected all on-chain calls and events related to the exploit. Balancer subsequently reached out to the exploiter addresses, offering a white-hat bounty for the return of funds.

2. **Berachain white hats:** On Berachain, white-hat bots briefly front-ran portions of the attack. [Berachain validators then coordinated an emergency halt](https://www.coindesk.com/markets/2025/11/03/berachain-halts-network-to-contain-balancer-linked-exploit-to-conduct-emergency-hard-fork), enabling the recovery of \~$12.8M, which was later returned to the foundation and followed by the launch of a user claims portal.

Message from Berachain Foundation, clarifying the status of the alleged exploiter's wallets, and informing funds recovery.

3. **StakeWise recoveries:** [StakeWise recovered approximately 5,041 osETH (\~$19M) and 13,495 osGNO (up to \~$2M) via targeted contract actions.](https://x.com/stakewise_io/status/1985462161670336944?s=20)

4. **Evasion example:** Despite freezes on Sonic network, one path moved 19.5M stS (\~$3M) to `0x0e9c9473D0c504Da72763426719F6f03A15544D5` by granting token permission via `permit()` and then calling `transferFrom()`, swapping to WBTC and bridging from Sonic to Ethereum using LayerZero. Since the freeze only affectes native tokens, not other ERC20 tokens, exploiter used permit() which allows off-chain signatures without requiring gas fees from the frozen address.

LayerZero Explorer showing transfer made from Sonic to Ethreum

5. **White-hat recovery:** Following the Balancer V2 stable-pool incident, [a new value-extraction path was identified in V2 meta-stable pools, which helped in securing \~$4.1M](https://x.com/Balancer/status/1988685056982835470?s=20) into controlled custody for reconciliation and return. ## Monitoring We’re actively tracking the exploiter cluster across chains; the majority of realized proceeds now sit on Ethereum consolidated in \~7 primary holding addresses, with small residuals on select L2s/sidechains. We’ve deployed a public Blockscope Watchtower for live alerting and transparency:

Address holding majority of the funds; Nearly $90M

## Conclusion The Balancer V2 exploit underscores how even mature, widely-audited DeFi protocols remain vulnerable to subtle arithmetic and logic flaws when deployed in highly composable environments. What began as a microscopic rounding bias in `EXACT_OUT` swaps escalated into one of the most extensive coordinated multi-chain exploits to date, draining over **$129M** across networks. While Balancer’s prompt coordination with white-hats, partners, and security teams helped contain further damage and recover partial funds, the incident also reignited an important discussion within the DeFi community. Many applauded the transparency and speed of the team’s post-incident actions, yet others voiced concern over the temporary halts and validator interventions on networks like Berachain, questioning whether such emergency measures align with the core ethos of decentralization. As the community awaits a full post-mortem, sentiment remains mixed, balancing appreciation for swift recovery efforts against growing unease about the trade-off between security and decentralization. This event highlights the urgent need for deeper scrutiny of economic-logic vulnerabilities, stronger precision handling in pool math, and better on-chain monitoring systems like Blockscope’s Forensics Suite to detect anomalies before they evolve into systemic crises. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope For more information, please reach out to us at ****

## Summary On October 10, 2025, the cryptocurrency market experienced the largest liquidation event in its history, **$19 billion** in leveraged positions were eliminated within 24 hours, [with some estimates placing the total above $30 billion](https://x.com/coinglass_com/status/1976796969961193641) when delayed exchange reporting is accounted for. This event erased \~**$1 trillion** in total market capitalization and exposed critical structural fragilities in crypto market infrastructure.

On Friday evening, Bitcoin went below $105K

In this article, we examine the trigger behind this crash, how the events unfolded, and what worked and what failed, during this historic market meltdown. ## The Macro Catalyst: Trump's Tariff Threat President Trump's October 10 announcement threatening [**100% tariffs on all Chinese imports**](https://www.usatoday.com/story/news/politics/2025/10/10/trump-100-percent-tariffs-china-imports-trade-war/86631090007/) starting November 1 served as the catalyst. Within three hours, Bitcoin crashed from $123,000 to $102,000, a $20,000 or 16.9% drop, erasing $380 billion in BTC market cap alone. Ethereum fell from $4,346 to $3,574 (17.8% decline), Solana dropped 30%, Cardano plummeted 30%, and select altcoins crashed 60-90%. An altcoin index recorded a near-40% collapse within minutes.

Top Crypto Liquidation Events since Covid

## Liquidation Cascade: Exchange-Level Breakdown The liquidation event unfolded with unprecedented velocity, approximately $7 billion was liquidated in a single hour on Friday evening. [Exchange-level data from Coinglass reveals severe concentration](https://www.coinglass.com/LiquidationData): * **Hyperliquid**: $10.3 billion liquidated, with $1.23 billion in trader equity wiped out and 6,300 wallets completely eliminated * **Bybit**: $4.65 billion liquidated * **Binance**: $2.41 billion liquidated Of the $19.1 billion total, **$16.7 billion came from long positions** (87.4%), reflecting extreme bullish positioning prior to the crash. Over **1.6 million individual traders** were liquidated. ## Winners in the Wreckage: Counter-Trend Profits While nearly everyone lost their money, few made fortunes. [Several whales capitalized on the rebound](https://www.mitrade.com/insights/news/live-news/article-3-1189334-20251013) : * **Wallet 0xe9d**: Closed a BTC long for **$265,000 profit** overnight * **Wallet 0x728**: Built ETH and SOL longs with **$1.56 million unrealized gain** * **World Liberty Financial advisor**: Opened a 20x long on 125.7 BTC ($14.3 million), later adding 3x long on 850,000 ASTER ($1.25 million) * **Wallet 0xb9fe**: After losing $2 million in liquidations, reopened a 25x long on 18,960 ETH ($72.7 million), recovering losses plus **$3.6 million profit** ### Pre-Positioned Whale Activity: Suspicious Timing On-chain analytics identified highly suspicious whale activity (`0xb317d2bc2d3d2df5fa441b5bae0ab9d8b07283ae`) preceding the crash : * **$1.1 billion short position**: A whale opened more than $1.1 billion in combined Bitcoin and Ethereum short positions hours before Trump's tariff announcement. * **$192-200 million profit**: This trader closed 90% of positions immediately after the crash, securing estimated profits of $192-200 million in a single day. * **Subsequent activity**: [The same wallet reopened a **$163 million Bitcoin short** on October 12](https://finance.yahoo.com/news/crypto-whale-opens-163m-bitcoin-065907801.html), currently sitting at over $3 million unrealized profit. The precision timing has sparked market manipulation investigations, with crypto attorney John Deaton publicly calling for regulatory scrutiny.

TheBitcoinOG is currently ranked third on the Hyperliquid leaderboard

https://x.com/lookonchain/status/1977917680691642742

### Hackers Panic Selling During the market turmoil, unusual on-chain behavior was observed as several hacker wallets panic-sold ETH for DAI, later buying back at significantly higher prices, a rare case of emotional trading even among exploiters.

## Market Recovery Metrics By October 13, markets showed tentative stabilization : * **Bitcoin**: Recovered to $114,000-115,000 (11.8% rebound from lows) * **Ethereum**: Climbed back above $4,100 (14.7% recovery) * **24-hour liquidations**: $620 million on October 13, with a 34-66 split favoring short liquidations, a complete sentiment reversal * **Volume surge**: Total 24-hour volume jumped 26.8%, suggesting re-entry by previously liquidated traders * **Bitcoin dominance**: Rose to 58.45%, indicating capital flight to large-cap safety ## Infrastructure Failures: What This Event Exposed **Leverage saturation**: Pre-crash Bitcoin open interest exceeded $50 billion, indicating dangerously crowded long positioning **Weekend liquidity vacuum**: The crash occurred after U.S. markets closed on Friday, removing institutional liquidity buffers **Cross-margin contagion**: Centralized exchanges' auto-liquidation of cross-margined collateral amplified altcoin selloffs **No circuit breakers**: Unlike traditional markets with coordinated halt mechanisms at 7%, 13%, and 20% thresholds, crypto exchanges operate independent risk engines with no systemic safeguards ### Bottom Line The October 10 liquidation event represents not merely a price correction but a market integrity stress test that revealed asymmetric information exploitation, infrastructure fragmentation, and the absence of coordinated risk controls across the trillion-dollar crypto ecosystem. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope For more information, please reach out to us at ****

Disclaimer: Best Effort Work This article reflects our best-effort analysis based on information available as of publication. Please note: * **Data limitations:** Sources may be incomplete and the dataset can contain inaccuracies, omissions, or errors. * **Subject to change:** New or updated evidence may emerge that could materially alter parts of this report. * **Interpretive nature:** Findings and conclusions are based on our current understanding and may evolve over time. * **No guarantees:** While we’ve taken reasonable steps to ensure accuracy, we cannot guarantee that all information is fully correct or complete. This document should be treated as a snapshot of knowledge at the time of writing and may be revised if reliable new information becomes available. # UXLink Exploit Analysis

## Summary On September 22, 2025, [**UXLINK** officially disclosed through X](https://x.com/UXLINKofficial/status/1970181382107476362) that their protocol had suffered a critical security breach involving their multi-signature wallet infrastructure, confirming an active exploit targeting the platform's core treasury systems. Within minutes of this disclosure, [Blockscope's forensic team initiated comprehensive on-chain tracing operations](https://x.com/BlockscopeCo/status/1970231199147884741) across Ethereum and Arbitrum, systematically mapping the initial theft vectors and asset movement patterns that would soon reveal the sophisticated nature of this attack.

https://x.com/BlockscopeCo/status/1970231199147884741

What initially appeared as a conventional multisig wallet compromise rapidly escalated into a multi-stage exploit when the attacker leveraged a delegateCall vulnerability to escalate administrative privileges, subsequently[ minting more than 10 trillion unauthorized UXLINK ](https://x.com/UXLINKofficial/status/1970318681931669825)tokens before systematically draining liquid assets worth millions through coordinated bridge operations and DEX/CEX liquidation pathways.

https://x.com/UXLINKofficial/status/1970318681931669825

Based on Blockscope's comprehensive ledger-level forensic analysis, **over $41 million in assets** have been confirmed as successfully stolen by the exploiters through systematic token minting, direct treasury drainage, and strategic conversion operations across multiple blockchain networks. [UXLINK](https://x.com/UXLINKofficial), a Web3 social infrastructure platform serving **55M+ users** with AI-powered Social Growth and Graph IP, went from steady momentum to a cautionary tale on September 22 after a smart-contract error triggered catastrophic liquidity depletion and a **\~70% token collapse**, shattering market confidence. This investigation reconstructs the exploit end-to-end, technical forensics, on-chain flows, and remediation, and extracts practitioner-grade lessons for Defi security.

## Decoding the Exploit The UXLINK exploit originated from a critical delegateCall vulnerability within the protocol's multi-signature wallet infrastructure, which allowed external callers to execute arbitrary code within the wallet's security context and bypass all intended access controls. The attacker systematically leveraged this flaw to execute a sophisticated privilege escalation attack, using delegateCall to remove existing administrative roles and invoke the "addOwnerWithThreshold" function, effectively installing themselves as the authorized wallet owner with unrestricted access to all treasury functions. Using Contract Analysis and Transaction Decoder tool we were able to see how the Primary Exploiter `0x2ef43c1d0c88c071d242b6c2d0430e1751607b87` levraged the flaw, eventually removing all the owners of the multisigs.

Flowchart showing the exploiter removing multisig ownership from UXLink’s main storage contracts.

This [initial breach resulted in the immediate drainage of \~12 million](https://x.com/BlockscopeCo/status/1970231199147884741) in liquid assets across Ethereum and Arbitrum networks, including $4 million in USDT, $500,000 in USDC, 3.7 wrapped Bitcoin, and 25 ETH, alongside millions of native UXLINK tokens from the compromised multisig wallets The exploit’s second phase saw the exploiter mint trillions of unauthorized UXLINK tokens, mostly on Arbitrum, and quickly convert the stolen assets and $UXLINK into DAI, and eventually to nealry 6700 ETH, worth nearly $28 Million and bridging the proceeds from Arbitrum to the Ethereum mainnet using [Across Protocol](https://across.to/) and [Defiway](https://defiway.com/).

Transcation Decoder shows, in on of the unauthorized minting transaction, the exploiter minted 10 trillion $UXLINK; Tx: 0x702189323aa5ddbd839b077cc27cede0550abc106ab89084ea2e069505a87577

Post-bridge, the attacker **consolidated value into ETH, wBTC & DAI on Ethereum**, by executing rapid swaps across DEX, majorly levraging Cowswap, and currently, the exploiter is holding all the funds on Ethereum. However, in a remarkable twist of irony, the attacker fell victim to their own vulnerability when [they unknowingly approved a malicious phishing contract](https://x.com/realScamSniffer/status/1970322013597450609) controlled by the Inferno Drainer network, resulting in the loss of \~542 million UXLINK tokens worth approximately $48 million during the asset shuffling process.

Tx. (Arbitrum): 0xa70674ccc9caa17d6efaf3f6fcbd5dec40011744c18a1057f391a822f11986ee

## On-Chain Activity The exploiter executed a near-simultaneous multisig takeover on Ethereum and Arbitrum, first pruning signers (via `removeOwner`-style updates) to seize execution control and open transfer/mint vectors. On Arbitrum, the adversary immediately minted unauthorized $UXLINK at extreme scale (in trillions), along with draining some crypto as illustrated in **Tracer 1.**

In parallel on Ethereum, the **Primary Exploiter** initiated the treasury drain; **Tracer 2** traces early inflows into `0xb819e6ae5a6668bb0ce02d64d130deca9ff83691` & `0x6385eb73fae34bf90ed4c3d4c8afbc957ff4121c` , which aggregate roughly **$12M** across USDC, USDT, WBTC, and ETH, reflecting a coordinated siphon rather than opportunistic dust collection.

With mint pressure established, the exploiter shifted into consolidation and egress. The strategy was straightforward: dump UXLINK → acquire ETH → bridge to Ethereum for deeper liquidity and broader off-ramps. This leg leveraged multiple DEX routes and DeFi primitives to minimize price impact and MEV capture while obscuring deterministic paths as shown in the **Tracer 3.**

After landfall on Ethereum, flows show a defensive rebasing into DAI-ETH positions to reduce volatility, freezing and slippage risk ahead of CEX attempts or further routing. The resulting stack now fans out across **\~10 holding addresses** as shown in **Tracer 4**, a classic distribution pattern that balances fragmentation with operational control.

## Breakdown and Timeline ### September 16, 2025 at 10:59 AM UTC The primary exploiter **`0x2ef43c1d0c88c071d242b6c2d0430e1751607b87`** first receives seed capital via **ChangeNOW**, then shortly after **bridges to Arbitrum through Across Pool**, pre-positioning liquidity on the target domain. This deliberate funding-and-bridging sequence reads as staging for the main operation rather than opportunistic movement.

Transactions show the exploiter receiving funds and soon bridging a portion via Across Protocol.

By decoding the bridge tx. using our AI investigator, we were able to verify the funds went to Arbitrum as initial funding; Tx (Ethereum): 0xc5157a78f4968c1f8ffc5b50f7c66a7d5b8db77fd6b2a8cec4c5e12e230ccf6a

### September 22, 2025 at 2:45 PM UTC Once aware of the vulnerability, likely well in advance, given the staging observed roughly a week prior, the exploiter struck both chains nearly simultaneously. Our AI Investigator’s reconstruction of the earliest transaction shows the attacker **seizing control of the multisig** by **removing the other three owners**, thereby transferring full execution authority to the attacker-controlled address.

Tx (Ethereum): 0x8130252ac8207e563d2bfd1ff6a496990630e9579f757f03c21ebb555b62df9e

Similarly on Arbitrum, the exploiter proceeded to change ownership and, in subsequent transactions, invoked the UXLINK contract to mint tokens at scale.

Transactions tab of Primary exploiter on Arbitrum

### September 22, 2025 at 2:54 PM UTC Once getting ownership, the first drain happens on Ethereum with two addresses which were funded by ChangeNow too, `0xb819e6ae5a6668bb0ce02d64d130deca9ff83691` & `0x6385eb73fae34bf90ed4c3d4c8afbc957ff4121c`, draining nealry \~$12M in USDC, USDT, wBTC and ETH.

Wallet profiler shows net token flows of `0xb819e6ae5a6668bb0ce02d64d130deca9ff83691`

### September 22, 2025 at \~3:00 PM UTC Once control was consolidated across the exploiter’s addresses, unauthorized minting on Arbitrum began, initially in the millions and escalating to transactions minting **up to 10 trillion $UXLINK.** (Tx: `0x702189323aa5ddbd839b077cc27cede0550abc106ab89084ea2e069505a87577`)

Wallet Profiler shows minting and swaps were happening systematically.
Wallet profiler shows token transfers of one of the early exploiter's address: `0x9d3b2d0e7925ed46c4a767acebfa013f9ab7d7cd`

### September 22, 2025 at \~3:20 PM UTC While tokens were being minted and swapped, the exploiter bridged the resulting ETH to Ethereum via **Across Pool and DeFiway**. To date, our tracing attributes **\~6,700 ETH (nealry\~$28M)** to this leg.

Tracer shows bridging of ETH from Arbitrum to Ethereum.

Meanwhile the bridged funds were being swapped for DAI on Ethereum, and being transferred to consolidation addresses. We were able to successfully trace nearly $26.5 Million worth of ETH bridged to Ethereum.

### September 25, 2025 at 2:15 AM UTC Nearly \~$41M worth of DAI and ETH are being held by ten addresses on Ethereum, waiting for the next move, while a majority of the funds are being seized by various instituions on Arbitrum. The table below lists all the addresses holding funds on Ethereum: | Addresses Holding Funds | | ------------------------------------------ | | 0x64ab9377a2b3bbb61dd79f8997e7f8c1cc1a4de8 | | 0x7277c705b5b1963b602cb4e3ab8e188d925bed00 | | 0xf35dde49a1bbe7a8883a8f35d48fb33c20a69b39 | | 0x7e1f34418e2da204a8eabdb29eddf7c09a494a3f | | 0x5210bfdf0cfe6471322d597d16cf440f5ac59309 | | 0xac77b44a5f3acc54e3844a609fffd64f182ef931 | | 0xd7aa2bd9e9407f682a379bed346088b0849b6434 | | 0x714dda349ef43326791f923e8389a21d11378c67 | | 0xa3ce95ac672b62ed75afbe6f50285c28ef717a44 | | 0xaade027d63ea859a4993961a8a8cc5aae3f020f3 | #### Additional Information Although this exploit was majorly active on Arbitrum and Ethereum, traces of the exploiter can be seen on Binanace Smart Chain too, with some activity of nealry $27K worth of assets in BUSDC, KILO and SOLV.

## Advanced Forensics and Monitoring Industry estimates for realized losses range widely—**\~$11.6M**, **\~$31M**, even **\~$45M**—because methodologies and considertaions differ . Our ledger-level attribution, constrained to realized proceeds under attacker control, confirms **\~$41M** to date. Every address in scope has been vetted with **cluster analysis** and **counterparty screening** to exclude third-party, victim, or scam wallets from the totals. In the first visualization below, two coherent clusters emerge: * a **funding cluster** seeded via **ChangeNOW**, comprising the primary exploiter and auxiliaries; * a **bridging cluster** receiving inflows from **Arbitrum** through Across Pool & DeFiway.

The second view links roles to behavior: the **right-hand cluster** maps to the **multisig drains**, while the **left-hand cluster** aggregates **bridged proceeds**, with both ultimately **consolidating into fresh holding wallets**. This separation of **drain vs. bridge roles** explains the variance in public tallies and underpins our stricter, realized-only accounting.

### Continuous Monitoring We have monitored this incident from day one and deployed **Blockscope Watchtower** coverage on all 10 current holding addresses. Track live movements, labels, and alerts here: **Public Watchtower:** [**https://www.blockscope.co/community/watchtowers/68d466735e4e2b61e527142a**](https://www.blockscope.co/community/watchtowers/68d466735e4e2b61e527142a) ## **Conclusion** The lone bright spot in this incident is UXLINK’s **measured, transparent communication**. Despite the lapse, the team has consistently acknowledged responsibility, issued frequent status updates, and taken pragmatic steps to protect user funds and stabilize the project. As of today, they report that a majority of the unauthorized tokens have been seized, and [new, audited contracts are deployed](https://x.com/UXLINKofficial/status/1971017352058974395), signals of a disciplined recovery posture rather than damage control.

https://x.com/UXLINKofficial/status/1971017352058974395

This was one of the most eventful security incidents in recent memory, chaotic flows, an exploiter who was phished mid-operation, and hours of uncertainty. Moments like this are exactly where firms like **Blockscope** add value: real-time on-chain monitoring, advanced forensics, and disciplined attribution that separates signal from noise. These capabilities don’t just explain what happened, they help stakeholders contain exposure, coordinate response, and harden controls for the next attempt. That is the difference between being surprised by an incident and staying ahead of it. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope For more information, please reach out to us at ****

## **The State of Play** Supply-chain attacks went from a rising risk in 2024 to a defining crypto threat vector in 2025. Earlier this year, [ReversingLabs documented 23 crypto-focused supply-chain campaigns](https://www.reversinglabs.com/blog/crypto-gets-a-target-on-its-back) in 2024, with npm representing 14 of these incidents. Against the backdrop of [\~$2.2B in total hacking losses for 2024](https://medium.com/@blockscope.co/2024-crypto-crime-and-security-44a368501b5d), the stage was set for this year's dramatic escalation.

The year started with a huge hit, in February 2025, Bybit suffered the largest theft in industry history (Losing \~$1.5B in ETH), [driven not by key compromise but by third-party UI tampering](https://research.blockscope.co/bybit-breach#decoding-the-exploit) (Safe Wallet) in its multisig flow; investigators describe a vendor-chain compromise that altered what operators saw at approval time. In May 2025, an [AI-plugin/IDE poisoning wave around Cursor led to \~$500K](https://research.blockscope.co/mid-year-2025-crypto-crime-report#id-6.-artificial-intelligence-threat-and-opportunity) in direct losses and exposed hundreds of developer machines to backdoors and stealer payloads. And recently, in September 2025, the JavaScript ecosystem was hit twice: first by[ a maintainer-phishing event](https://research.blockscope.co/npm-hack) that pushed crypto-drainer code into 18+ core npm packages (e.g., `chalk`, `debug`) with total \~2.6B weekly downloads, and days later by [a worming campaign (“Shai-Hulud”)](https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised) that hijacked @ctrl/tinycolor and, via credential theft and CI pivoting, spread to 100–180+ packages.

## **What are Supply Chain Attacks in Crypto?** A supply-chain attack exploits the trust you place in everyday development tools, the package managers, build systems, wallet SDKs, and IDE extensions that feel as routine as morning coffee. Attackers don't break down your front door; they poison the water supply, inserting malicious code into trusted updates that flow naturally through your normal workflows. In crypto, this trust sits at the most dangerous intersection: where value meets authorization. Wallet SDKs that construct transactions, signer UIs that display what you're approving, CI pipelines that build your front-end, these aren't just tools, they're the critical path between human decision and digital money. The pattern repeats with surgical precision: Bybit users thought they were seeing legitimate transaction details when a compromised vendor UI fed them lies. Thousands of npm users received "routine" updates that quietly rewrote recipient addresses or hooked into wallet flows, all delivered through the same trusted channels they used every day. One compromised maintainer account becomes a distribution network reaching across the internet. The cruelest part? Everything looks normal. Your IDE suggests the update, your build passes, your tests are green. The attack succeeds precisely because it arrives through channels you trust, wearing the clothes of legitimate maintenanc ## Humans, Payloads, Worms: The Supply-Chain Path Attackers don’t hack blockchains, they hack people, then the pipeline. *Phish → publish → propagate*.

#### **Step 1 - Break the person, Not the system** In the npm wave, core maintainer [Qix fell for a 2FA-reset phish](https://research.blockscope.co/npm-hack#initial-compromise-a-look-alike-npm-support-domain) threatening account lockdown, giving attackers control within an hour. In the Bybit heist, [a Safe{Wallet} developer was socially engineered](https://research.blockscope.co/bybit-breach#decoding-the-exploit) through stolen AWS tokens and MFA bypass, his compromised workstation opened the door to everything that followed. #### **Step 2 - Legitimize the payload** With the npm account, [attackers pushed "routine" updates to `chalk`, `debug`, and 16 other packages](https://research.blockscope.co/npm-hack#background-why-compromising-qix-was-a-global-fire-alarm-moment) that ran install-time credential stealers harvesting developer tokens and cloud access. [At Bybit, attackers injected malicious JavaScript into the trusted vendor UI](https://research.blockscope.co/bybit-breach#decoding-the-exploit), so signers approved transactions that looked legitimate, but weren't. [The same "looks-legit" trick powered Cursor](https://mp.weixin.qq.com/s/wmmI_M0VyLnxoJX-7DV8Xg): a fake "Solidity Language" extension from Open VSX executed PowerShell during installation to exfiltrate secrets, leading to \~$500k in wallet thefts. #### **Step 3 - Amplify and spread.** The npm worm auto-cascaded from 18 initial packages to 187+ compromised releases through stolen maintainer tokens, billions of weekly downloads spreading faster than teams could respond. [Shai-Hulud demonstrated the same pattern](https://cybersecuritynews.com/npm-supply-chain-attack-crowdstrike/), worming from `@ctrl/tinycolor` to 100+ packages in one campaign. Meanwhile, Bybit's attackers rapidly drained $1.5 billion in ETH across multiple addresses once UI approvals were subverted, making it crypto's largest single heist. The pattern repeats everywhere trust intersects with valuable access: Bybit's compromised vendor UI manipulated transaction displays at the critical moment of user approval. Cursor's ecosystem showed how alternative extension registries can become backdoor distribution networks, turning developer workstations into surveillance posts. Each attack exploits the same fundamental weakness: humans making trust decisions under time pressure, using tools that look legitimate because they are legitimate, until they're not. ### **Why this is worse than “Just Phishing”** Phishing scales one victim at a time; supply-chain compromise scales **one maintainer → millions of downstream installs** in minutes. It abuses transitive trust, so warnings and training aimed at end-users don’t apply, developers install “updates” from known names, CI builds “as usual,” and signers approve transactions in UIs that look correct. Modern campaigns also harvest tokens and secrets at scale, letting attackers leapfrog into orgs’ build systems and vendors, which is why the npm incidents demanded industry-wide emergency triage even where *confirmed* on-chain thefts remained relatively small. ## Defend Your Pipeline: Do This Next Treat supply-chain risk like hot-path fraud risk: Verify at the moment of authorization and reduce transitive trust. Concretely: (1) Verify the raw transaction, recipient, amount, calldata, with an independent tool (e.g., **Blockscope Transaction Simulator**) before signing; don’t rely on a single vendor UI. The Bybit attackers manipulated the trusted Safe{Wallet} interface precisely because users relied on one source of truth. On any signing surface, enforce strict [Content Security Policy and Subresource Integrity for third-party JS](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides) to prevent tampering.

Blockscope Transaction Simulator lets you preview a transaction’s effects before signing, so you can verify the recipient, amount, and calldata behave as intended.

(2) Pin and verify dependencies; gate publish rights to essential maintainers only; alert immediately on ownership transfers, the npm attack succeeded because Qix's compromised account had broad publishing access. Quarantine post-install scripts by default; they're prime real estate for credential harvesting. (3) Adopt [SLSA (Supply-chain Levels for Software)](https://slsa.dev/) -style provenance and reproducible, signed builds so consumers can cryptographically verify artifact integrity. This breaks the "looks legitimate" deception that powered all three attacks by creating an auditable chain from source commit to final package. (4) Short-lived, scoped tokens limit blast radius, [the Shai-Hulud worm spread because stolen CI tokens had persistent access](https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised). Isolate CI runners to prevent cross-contamination; alert on workflow edits and unexpected publishes. Automation should be predictable, not surprising. (5) Harden dev machines; Official marketplaces only for extensions (the Cursor attack exploited alternative registries like Open VSX), Workspace Trust enabled to sandbox untrusted projects, and operational signing on hardware wallets with on-device address confirmation, making UI manipulation attacks like Bybit's impossible since the hardware shows the real recipient, not the spoofed one. ## **The Meta-Lesson** These attacks succeed because they exploit trust at scale. Your defense must verify at scale too, every signature, dependency, and CI run becomes a verification checkpoint rather than a trust assumption. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope For more information, please reach out to us at ****

Disclaimer: Best Effort Work This report reflects our best-effort analysis based on information available **as of publication**. Please note: * **Data limitations:** Sources may be incomplete and the dataset can contain inaccuracies, omissions, or errors. * **Subject to change:** New or updated evidence may emerge that could materially alter parts of this report. * **Interpretive nature:** Findings and conclusions are based on our current understanding and may evolve over time. * **No guarantees:** While we’ve taken reasonable steps to ensure accuracy, we cannot guarantee that all information is fully correct or complete. This document should be treated as a snapshot of knowledge at the time of writing and may be revised if reliable new information becomes available. # RCMP Busted TradeOgre: Canada’s Biggest Crypto Enforcement Yet

On September 18, 2025, [the Royal Canadian Mounted Police executed Canada's largest cryptocurrency seizure](https://rcmp.ca/en/news/2025/09/rcmp-executes-record-seizure-more-56-million-dollars-cryptocurrency)-over $56 million-and dismantled the TradeOgre exchange following a year-long Money Laundering Investigative Team (MLIT) probe initiated by Europol intelligence in June 2024. The operation represents Canada's first and most significant complete cryptocurrency exchange takedown, establishing critical precedent for multi-jurisdictional crypto enforcement.

The TradeOgre website now displays an **RCMP seizure notice**, confirming official control of the platform.

[TradeOgre's violations centered on systematic non-compliance with Canadian AML requirements](https://rcmp.ca/en/news/2025/09/rcmp-executes-record-seizure-more-56-million-dollars-cryptocurrency): failure to register with FINTRAC as a money services business (MSB), absence of KYC/identity verification protocols, and no suspicious activity monitoring or reporting mechanisms. Users could onboard with a name and an email before freely transacting funds. Most significantly, [RCMP alleges that a majority of the platform's transaction volume originated from criminal sources](https://decrypt.co/340310/canada-confiscates-56m-bitcoin-xrp-crypto-shutters-exchange-tradeogre), indicating not incidental abuse but systematic exploitation of the platform's anonymity features. Open-source investigations have long associated TradeOgre with privacy-heavy flows and alleged laundering routes, including community traces linked to the [2021 Cream Finance exploit](https://pastebin.com/1R5xiFUL) and various other illicit activities**.** In March 2025, there was [a case filed in the US for a $40M theft of BTC](https://www.offshorealert.com/mandar-mirashi-v-521-99931468-bitcoin-et-al-complaint-40m-crypto-theft/), where TradeOgre was one of the defendants.

Source: https://www.offshorealert.com/mandar-mirashi-v-521-99931468-bitcoin-et-al-complaint-40m-crypto-theft/

But this whole operation and seizure didn't happen suddenly. [The first bell rang two months ago](https://www.reddit.com/r/monerosupport/comments/1mdktbg/what_happened_to_tradeogre/?utm_source=share\&utm_medium=web3x\&utm_name=web3xcss\&utm_term=1\&utm_content=share_button), when Reddit threads documented radio silence, stuck withdrawals, and downtime, with the exchange's users torn between "seizure" versus "exit" theories.

In hindsight, those user reports map directly to a covert operational phase preceding the public takedown. As reported by RCMP, the agency started to work on this case last year. On-chain activity shows the operations of the exchange halted at the end of July 2025, and finally on 15 September, 2025, the seizure of various funds started, including Bitcoin, Ethereum, XRP, Litecoin, Tron, and Qubic, totaling nearly $56M, which are largely clustered around $14.7M on Bitcoin and $16.3M on Ethereum, as tracked via blockchain analysis tools.

Blockscope Tracer identifies funds flowing from TradeOgre into wallet attributed to RCMP control

RCMP-controlled wallets exhibit characteristic law enforcement signatures: Bitcoin OP\_RETURN messages indicating custody, systematic UTXO consolidation rather than exchange-style transaction churn, and Ethereum-based custody signals. These on-chain markers provide real-time verification of asset control and demonstrate the sophistication of modern crypto forensics in enforcement actions. The blockchain evidence validates the enforcement narrative while providing transparent asset tracking for the ongoing investigation.

On-chain message by RCMP on Ethereum. Tx hash: 0xd79dbe67201ada1c3bb94b05b8c6af46e4bc00c9f340ab7f324ef3b7778a028e

The only unfortunate aspect of this whole operation is that all the user funds remain frozen pending investigation outcomes, potential charges, and any forfeiture or claims process. For affected users, meticulously preserved deposit/withdrawal proofs, addresses, and correspondence will be essential if a claims pathway opens. [Multiple discussions are ongoing across Telegram groups and Reddit threads as users seek clarity on recovery prospects](https://www.reddit.com/r/BitcoinCA/comments/1nkczdv/for_those_in_canada_affected_by_the_tradeogre/?utm_source=share\&utm_medium=web3x\&utm_name=web3xcss\&utm_term=1\&utm_content=share_button). The disconnect between user expectations of privacy-focused platforms and the legal realities of AML enforcement creates significant operational and reputational risks for similar venues.

This enforcement action, Canada's largest crypto seizure and the first dismantling of a trading venue by Canadian law enforcement, exemplifies the maturation of cryptocurrency enforcement capabilities. The integration of cross-border intelligence sharing, advanced blockchain forensics, and coordinated legal action provides a replicable model for addressing systemically non-compliant cryptocurrency platforms. The case signals that regulators will increasingly target platforms based on criminal flow analysis rather than merely procedural violations, establishing systematic criminal exploitation as a threshold for decisive enforcement intervention. The operational lesson for professionals is stark: counterparty risk is visible on-chain, and when compliance frameworks fail, platform closure can be sudden, attribution public, and asset control transparent block-by-block. The TradeOgre takedown demonstrates that technical obfuscation and jurisdictional arbitrage offer no protection against modern enforcement capabilities when criminal exploitation reaches systematic levels. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope For more information, please reach out to us at ****

## Executive Summary [On September 8, 2025](https://bsky.app/profile/charlieeriksen.bsky.social/post/3lydffcyulc2n), the cryptocurrency ecosystem faced one of its most severe security threats when the account of a long-trusted maintainer known as **Q*****ix*** (Josh Junon) was hijacked through a phishing email, and 18 popular packages were altered with malicious code. Those packages include chalk, debug, and ansi-styles, which together represent more than two billion weekly downloads. [This supply chain attack represents the largest npm attack ever recorded](https://cointelegraph.com/news/large-scale-npm-attack-compromised-less-50-dollars), injecting sophisticated cryptocurrency-stealing malware into core JavaScript libraries used by millions of developers worldwide.

The compromised packages contained malware specifically designed to target cryptocurrency wallets across multiple blockchains, including Ethereum (EVM), Bitcoin, Litecoin, Solana, and Tron. Despite having unprecedented access to millions of systems globally, the attacker's actual financial gain appears minimal, highlighting both the severity of the breach and the importance of rapid community response in mitigating large-scale threats. ## Background: Why compromising “Qix” was a global-fire-alarm moment [Qix (Josh Junon)](https://bsky.app/profile/did:plc:tcs6tvaixll4nz6bk5jqfxdu) is a long-time maintainer of chalk and debug (plus color/ANSI utilities) that sit at the base of enormous dependency trees, from CLIs to framework tooling to production servers. Even tiny patch bumps ripple through CI pipelines and front-ends worldwide. [Qix’s own profile notes he co-maintains two of the top ten JavaScript packages on npm.](https://github.com/sponsors/Qix-) The criticality of this compromise cannot be overstated. For e.g, [**Chalk**](https://github.com/chalk/chalk) is a terminal styling library used across virtually every JavaScript project, while [**Debug**](https://www.npmjs.com/package/debug) provides debugging utilities that are integral to development workflows. When these core dependencies are compromised, the attack surface extends to every application that relies on them, creating a cascading effect throughout the entire technology ecosystem. Security vendors pegged weekly downloads of affected packages in the hundreds of millions; **chalk** alone is \~**299M/week** and **debug** \~**47M/week**. That’s a supply chain blast radius of historic scale. For the crypto community specifically, this attack was particularly dangerous because many decentralized applications (dApps), wallet interfaces, and trading platforms rely heavily on JavaScript and Node.js infrastructure. The malware was specifically crafted to target cryptocurrency transactions, making it a direct threat to users' digital assets. ## Initial Compromise: A look-alike npm “support” domain The maintainer (Qix) was phished via **support\@npmjs\[.]help** (a typosquatted domain), lured to a bogus 2FA page that **captured username, password, and one-time codes** and exfiltrated them to attacker infrastructure. [SEAL Intel documents the infrastructure](https://www.securityalliance.org/news/2025-09-npm-supply-chain) (BunnyCDN buckets and `websocket-api2.publicvm[.]com`) used in the capture flow.

Once the attacker gained control of qix's npm account, they published malicious versions of 18 different packages. The attack was executed with surgical precision, injecting payload code that would only activate in browser environments where cryptocurrency wallets might be present. The payload doesn't actually run if typeof window == undefined as is the case in NodeJS runtime, showing the attacker's understanding of where their malware would be most effective. ## The First Alert: Community detection and response The security community's rapid response was crucial in limiting the attack's impact. Thanks to the hackers too, as their mistakes caused crashes in CI/CD pipelines, which led to early detection and limited impact. [Aikido Security flagged it as the largest npm attack ever recorded](https://x.com/AikidoSecurity/status/1965135645900427399), with 18 packages like chalk, debug, and ansi-styles hacked to hijack crypto wallets via injected code. Security researchers quickly identified the malicious payload and began analyzing its capabilities. [SEAL Intel](https://www.securityalliance.org/news/2025-09-npm-supply-chain) published a detailed timeline and sample payload the same day, time-stamping the compromise to **\~9:30 a.m. ET** and giving indicators of compromise (IoCs). [GitHub issues were immediately opened](https://github.com/debug-js/debug/issues/1005) on the affected repositories, with developers reporting the compromise across multiple channels. Malicious payload is on line 11 of src/index.js was identified in the chalk package, providing the community with specific locations to examine and verify the threat.

https://github.com/debug-js/debug/issues/1005

## Decoding the Malicious Package: Understanding the malware The malware demonstrated sophisticated cryptocurrency-targeting capabilities through two primary attack vectors: #### Passive Address Swapping Uses "lookalike" addresses (via string-matching) to make swaps less obvious. This technique involves monitoring user input and clipboard content for cryptocurrency addresses, then substituting them with attacker-controlled addresses that appear similar to the original. The visual similarity makes it difficult for users to detect the substitution during casual inspection. #### Active Transaction Hijacking The more dangerous component involved real-time transaction manipulation & hijacking. Alters Ethereum and Solana transaction parameters (e.g., recipients, approvals, allowances). Even if the UI looks correct, the signed transaction routes funds to the attacker. This means that even when users carefully verify transaction details in their wallet interface, the underlying transaction data could be modified before signing. ### Target surface The hard-coded replacement lists span **multiple chains**, not just EVM: * **EVM chains** (Ethereum and EVM-compatible): `0x…` addresses * **Bitcoin:** legacy `1…`/`3…` and Bech32 `bc1…` formats * **Litecoin:** `L…` / `ltc1…` formats * **Solana:** base58 public keys * **Tron:** `T…` addresses The corpus contains **a large set of candidate sink addresses**, with only a subset observed “activated” so far; many remain dormant. The practical emphasis of the code paths, and early on-chain activity, skews EVM-first, with multi-chain fallbacks present for broader coverage. ### Analyzing the Malware Our team conducted a thorough analysis of the malicious code to understand its nature and how it operates.

## Blockscope Traces: Early on-chain signals Despite the massive scale of the potential attack surface, our analysis reveals that the attacker's actual profits were surprisingly minimal, below $500. The first wallet activity was detected for address `0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976`, which showed limited transaction activity, stealing nearly $428.74 worth of ETH from two users, which have been attributed as some Open sea users.

Nearly $428.74 worth of ETH, along with few meme coins were stolen by 0xFc4a...

Wallet profiler showing current protfolio of one of the hacker's address

The address `0x93Ff376B931B92aF91241aAf257d708B62D62F4C` has shown activity on the Base network, where it is reported to have stolen small amounts, often just a few cents.

Also, there have been some reports of losses linked to this malware attack on solana, [stealing \~285 SOL](https://x.com/aaronM_34/status/1965015903877423210), but no verified evidence have been found.

https://x.com/aaronM_34/status/1965015903877423210

Notably, most of these addresses remain inactive, with some being activated but not used for malicious purposes. This suggests either the attack was discovered and mitigated before significant damage occurred, or the attacker chose not to exploit their position fully. A comprehensive list of potentially hacker addresses has been compiled and is available at: ## How the Attackers *could* have caused far more damage (and why they couldn’t) Just for clarity: this is a **defensive** analysis, not a how-to. Our goal is to examine what went wrong and what went right from an OPSEC perspective. * **Scope vs. Execution context:** With publish rights over ultra-popular packages, the hacker had theoretical reach into **billions of browser sessions**. But the payload **didn’t target Node runtimes** (no persistence via `postinstall`, no token/secret harvesters for servers). That choice drastically limited blast effectiveness. * **No Stealth on CI:** The code’s `fetch` override threw errors in automated builds, creating noisy, self-reporting failures that outed the compromise rapidly and raised alarm. * **Rapid Community Detection:** Issues and advisories landed within hours, giving defenders concrete IoCs and fixed versions. The upshot; Enormous potential control surface, but **operational choices + community speed** converted a doomsday vector into a costly cleanup drill.

https://x.com/P3b7_/status/1965336272550899932

## Conclusion This was a near-miss attack with a planetary blast radius, the largest npm supply chain attack in history, compromising 18 packages with over 2 billion weekly downloads through a successful phishing attack on a maintainer. [Crypto users are urged to take extreme care as NPM attack hits core JavaScript libraries](https://cointelegraph.com/news/npm-attack-crypto-stealing-malware-into-core-javascript-libraries). Despite the massive potential impact, actual losses were minimal (under $500 verified). The malware was designed to hijack crypto transactions by intercepting wallet APIs and swapping addresses, but its browser-only targeting and noisy implementation limited effectiveness. The real takeaway: we witnessed what a disciplined hacker with better tradecraft could have accomplished. One compromised maintainer nearly weaponized billions of JavaScript sessions. This was a stress test of our defenses, not a victory, and the next attempt may not be as sloppy. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope

Disclaimer: Best Effort Work This report reflects our best-effort analysis based on information available **as of publication**. Please note: * **Data limitations:** Sources may be incomplete and the dataset can contain inaccuracies, omissions, or errors. * **Subject to change:** New or updated evidence may emerge that could materially alter parts of this report. * **Interpretive nature:** Findings and conclusions are based on our current understanding and may evolve over time. * **No guarantees:** While we’ve taken reasonable steps to ensure accuracy, we cannot guarantee that all information is fully correct or complete. This document should be treated as a snapshot of knowledge at the time of writing and may be revised if reliable new information becomes available. # Coinbase Approval Exploit: How Mis-Scoped Allowances to 0x Settler Enabled a Drain. This report analyzes the Coinbase fee wallet drain, the 0x Settler approval misstep, and related composability risks with 0x Settler, highlighted by Zora.

## Summary On August 13, **Coinbase's fee-receiver wallet** lost approximately $550,000 due to mistakenly granting ERC-20 allowances to **0x's Mainnet Settler,** a permissionless execution contract. This wasn't a hack or exploit; it was a configuration error that handed a sophisticated MEV bot the approval to drain dozens of token types from Coinbase's treasury. The incident was first flagged by security researcher [@deebeez](https://x.com/deeberiroz/status/1955718986894549344), who provided initial analysis of the attack. Hours later, [Coinbase's CSO confirmed](https://x.com/SecurityGuyPhil/status/1955780896071803036) it was an isolated issue that occurred due to changes in a corporate DEX wallet implementation; customer funds were not affected.

Also, extensive discussions were comparing the [Coinbase incident with Zora’s earlier “Composability Attack,” involving 0x’s Mainnet Settler](https://coinsbench.com/how-75k-in-zora-was-claimed-without-hacking-the-code-43df4857d0cc), which resulted in losses of approximately $128k and $75k. This article outlines how the Coinbase exploit unfolded, highlights the differences from Zora’s composability path, and details the controls that could have prevented or mitigated both attacks. ### Understanding 0x Protocol and Why Coinbase Uses It Before we start going into the technicalities of the incidents, let's go through some of the background of the protocol involved. [0x](https://x.com/0xProject) operates as a sophisticated execution and aggregation layer in the DeFi ecosystem, building optimal trading routes across AMMs (Automated Market Makers), RFQ makers (Request for Quote), and bridges before settling transactions atomically through their Mainnet Settler contract. When users execute swaps through Coinbase's interfaces that leverage 0x aggregation, the settlement process generates affiliate fees that flow to designated Coinbase fee wallets, explaining why these addresses regularly interact with 0x Protocol's infrastructure.

Coinbase features 0x Protocol as one of its partner swap providers

The Settler contract itself embodies a fundamental DeFi principle: permissionless execution. Anyone can call it, which enables powerful composability and innovation. However, this same openness becomes dangerous when users grant it token spending rights. [0x's documentation couldn't be clearer on this point](https://0x.org/docs/0x-swap-api/introduction): "NEVER set an allowance on the Settler… ONLY on Permit2 or AllowanceHolder."

### Major Addresses Involved **• Coinbase Fee:** `0x382ffce2287252f930e1c8dc9328dac5bf282ba1` **• Exploiter:** `0x17f79e70ae89c6e32a9244d3d57b7aa648246468` **• Bot:** `0xac13439d598cd1a60c14c965ed0fa7c46cb0d89d` ## Decoding the Incident First, to clarify: **there was no bug, no exploit in the code.** The failure was authorization: Coinbase's fee wallet issued ERC-20 approvals to a permissionless executor (0x Settler). Once an allowance exists for `(owner=CoinbaseFee, spender=Settler, token=X)`, any caller can instruct Settler to `transferFrom` and route those tokens. Unfortunately, that's exactly what a bot did: pull, swap (often via WETH/Uniswap v3), and consolidate. [Public reporting pegs the loss at roughly **$300k**](https://cointelegraph.com/news/coinbase-0x-contract-error-mev-bot-300k-loss?utm_source=chatgpt.com) and cites CSO confirmation/cleanup (revokes and rotation). However, **Blockscope's analysis found the losses exceeded $550K**. Sophisticated bots monitor real-time `Approval` events to known public executors; when a high-value wallet grants broad allowances, they immediately craft Settler calls to drain funds. This isn't mempool front-running or sandwich attacks, it's exercising already-granted rights. ## On-Chain Activity Using the **Blockscope Tracer**, we reconstructed the entire incident flow and mapped out the movements of every token drained from the Coinbase fee wallet. Tracer 1 clearly shows the fee wallet being emptied across **\~168 different ERC-20 tokens**, each forwarded into various DeFi pools for swaps. These swaps consistently routed through popular AMMs, with the majority of tokens eventually consolidated into wETH.

Trace 1 shows token transfers from Coinbase Fee wallet to the Bot, including wETH swaps.

In Tracer 2, the breadth of the operation becomes visible: the draining bot interacted with close to **180 different DeFi pools**, a scatter-pull strategy designed to liquidate the diverse holdings of Coinbase’s wallet.

Trace 2 shows the use of various DeFi protocols to swap all tokens into wETH.

Each approval granted to the 0x Settler contract, tokens like AMP, MYRIA, DEXTools, Swell, and stablecoins like USDT, PyUSD, and many others, was methodically exploited. A bot EOA invoked `Settler.execute(...)`, and internally, the flow followed a repeating pattern: `transferFrom(owner=CoinbaseFee, spender=Settler, token=X)` → `AMM swap` → `Payout to the bot’s addresses` Tracer 3 then captures the consolidation phase. After dozens of incremental drains, the outputs were simultaneously swapped into wETH and finally converted to ETH. The ETH proceeds were then deposited into the exploiter’s consolidation wallet. Alongside this activity, we can observe the bot paying priority fees (bribes) to block builders during the swaps, ensuring the draining bundles were included without interruption.

Trace 3 depicts the swap of wETH to ETH, consolidation of funds into the exploiter wallet, and bribes paid to miners throughout the operation.

Blockscope traces highlight just how systematic the whole attack was: a broad scatter-pull of tokens, hundreds of DeFi pool interactions, followed by a consolidation funnel into ETH, all executed under the cover of validator bribes. This pattern matches the classic playbook bots use when approvals to permissionless executors cover many assets at once, fast, exhaustive, and ruthlessly efficient. ## Breakdown and Timeline ### • August 13, 2025, at 17:09 UTC The very first action that enabled this incident was the Coinbase fee wallet granting approvals to the 0x Mainnet Settler contract. Using **Blockscope** **Wallet Profiler**, we observed multiple function calls where the wallet executed `approve()` transactions across dozens of ERC-20 tokens. When these approval transactions were decoded and examined with **Blockscope’s AI Investigator**, it became clear that Coinbase had given the Settler contract broad token spending rights. This misconfiguration set the stage for the subsequent drain. **First Approval Tx:** `0xc4c090334cb46ca327a6d833db3dc69ecbaf38ecb29ba53ae996951d828fabe8`

Coinbase Fee account giving approval to 0x Settler on various tokens

Using Blockscope AI Investigator, we could see the details of the approval transaction

### • August 13, 2025, at 17:10 UTC The first transfer occurred at 17:10 when the exploiter initiated the attack by calling the 0x Settler contract and draining Coinbase's fee account for ORN (Orion Protocol) tokens. The bot immediately executed swaps to convert the tokens to ETH, transferring proceeds to the exploiter's wallet while paying bribes to block builders for priority inclusion. From that point forward, it became a continuous streak of drainage, swaps, and consolidation across multiple token types. Tx: `0xc1fde1d472dc682bd68c4dff005d50b360c8f8fba491c636388a25b5757e3abb`

Transaction Decoder shows various address interactions during the above given transaction.

Using Blockscope AI Investigator, we were able to analyze and simplify the complex DeFi operation involved in the transaction

### • August 13, 2025, 21:35 UTC The exploit continued for more than 4 hours, during which the bot successfully consolidated $525K worth of ETH (pure profit, excluding miner bribes and gas fees for swaps). As of now, the exploiter's wallet is holding all the funds and hasn't conducted any further operations.

Last token tranfers made by the Bot (Exploiter)

Wallet Profiler showing current holdings of the Exploiter Wallet

### Additional Findings The exploiter's wallet was funded by a **smart contract that has been labeled as a scam** (`0x4de23f3f0fb3318287378adbde030cf61714b2f3`) on various open-source platforms and blocked by multiple centralized entities. **Blockscope's Wallet Profiler** has already provided comprehensive labels for the address, revealing that it was involved with Tornado Cash, appears on the OFAC sanctions list, and has been blacklisted by Tether. There is some exposure to KYC entities, which will require further analysis to identify the entity behind the operation.

## Coinbase vs. Zora: Different Attack Vectors [**Zora incidents**](https://coinsbench.com/how-75k-in-zora-was-claimed-without-hacking-the-code-43df4857d0cc) were an outcome of a[ **composability attack**](https://blockaid.io/blog/composability-attack-deep-dive-how-an-attacker-stole-128k-without-an-exploit) with no broken code involved. This attack happens when two otherwise safe systems, combined, create an unintended path for value extraction. In Zora’s case, the claim logic legitimately allowed claims to any recipient, and the 0x Settler is a public executor anyone can call. Allocations intended “for 0x” were sent to the Settler’s address; an attacker then used Settler to call Zora’s claim on Settler’s behalf and redirect the payout to their wallet. No code was broken, each component behaved as designed, but their composition enabled ≈**$128k** in losses, followed by a ≈**$75k** reprise using the same “public, permitted functions chained together” pattern.

Exploiter got Zora tokens due to compositability vector. Tx:`0x1b2f86f24873deac06d02bda5332a54f8ffe1e32facf40901f408a7b398f9d43`

However, the Coinbase event was not a composability attack; it was an **authorization mistake**. The fee wallet approved the public Settler contract as a spender, and a bot simply used those allowances to `transferFrom` tokens and swapped them out. In short: **Zora = safe parts combined poorly; Coinbase = mis-scoped approvals to a public executor.** ## Risk Management and Prevention Strategies To safeguard against incidents like Coinbase and Zora, both individuals and institutions must adopt a layered defense strategy, combining secure protocol design, disciplined wallet policies, and continuous monitoring with advanced tools like Blockscope. **• Protocol-Level Safeguards:** Design out the risk: never grant approvals to public executors/routers (especially when the docs explicitly warn against it). Use Permit2 and AllowanceHolder for scoped, time-limited spend so no standing rights live on a permissionless contract. **Blockscope Smart Contract Analyzer** helps you understand contract behavior and surfaces risky function paths before integration. **• Corporate Wallet Policies:** Enforce a strict approval policy: maintain a spender allow-list (Permit2, AllowanceHolder, vetted bridges only) and use receive-only fee wallets with periodic sweeps to an ops wallet for swaps. Apply this via your signer/custodian policy, and enable **Blockscope Watchtower** and **Security Monitoring** alerts on any attempt to approve non-approved executors.

**• Detection and Monitoring:** Continuously watch for (wallet, token, spender) allowance deltas, especially to known permissionless executors. Use the **Blockscope Transaction Simulator** to pre-simulate call trees and ensure transactions behave as intended before broadcast.

**• The Limits of Privacy Solutions:** Consider **encrypted mempools** to mitigate sandwiching/front-running, not allowance-based drains. Once on-chain permissions exist, bots can exploit them without ever seeing your pending transactions. ## Conclusion The Coinbase loss is best categorized as allowance mismanagement amplified by a permissionless executor, a preventable operations error, not a code exploit. The Zora incidents are composability attacks: *individually safe* contracts that, when combined, produce an unintended extraction path. Both teach the same lesson: in a permissionless world, who you grant authority to, or which public contracts you treat as trusted recipients, matters as much as code safety. Note: The nuance on amounts: public coverage cites \~$300k, while Blockscope data shows losses \~ $550K on the basis of valuation timestamp, inclusion/exclusion of small dust tokens, and count post-drain swaps and transfers. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope For more information, please reach out to us at ****

## Executive Summary In the early hours of December 28, 2020, while the crypto industry celebrated Bitcoin’s surge past $27,000, a lesser-known Chinese Bitcoin mining pool named [LuBian quietly became the victim](https://www.coindesk.com/tech/2025/08/02/arkham-says-usd3-5b-lubian-bitcoin-theft-went-undetected-for-nearly-five-years?utm_source=chatgpt.com) of an unprecedented heist. An astonishing 127,426 BTC, valued at around $3.5 billion at the time and roughly $14.5 billion today, vanished without a trace. Yet, remarkably, the world remained oblivious to the largest crypto theft in history until nearly five years later. On August 2, 2025, Blockchain analytics firm [Arkham shattered the silence with a post on X](https://x.com/arkham/status/1951729790299394113), finally uncovering the staggering details of this hidden catastrophe. The LuBian incident starkly reveals how opaque operational practices, weak security protocols, and the dormancy of stolen funds can obscure massive financial losses, underscoring the urgent need for stronger security measures and transparent institutional crypto custody engineered to withstand both adversaries and hindsight. ## LuBian’s Brief Rise and Mysterious Disappearance Founded with operations spanning China and Iran, [LuBian](https://lubian.com/index.html) quickly climbed the ranks of Bitcoin mining pools. At its peak, [LuBian controlled about 6% of the Bitcoin network’s hashrate](https://mempool.space/mining/pool/lubiancom), making its centralized treasury holdings systemically significant. However, the promising trajectory abruptly halted in early 2021, when [LuBian inexplicably disappeared from public view](https://bitcointalk.org/index.php?topic=5359963.0)—a mystery now plausibly linked to the December 2020 theft.

## Unraveling the Incident: Weak Keys and Coordinated Withdrawals The chain of events leading to LuBian’s collapse began on December 28, 2020. The primary vulnerability behind this huge mess is thought to be a disturbingly elementary, weak private-key generation process susceptible to brute-force attacks, a foundational security oversight for custodial operations of this magnitude. In a swift, coordinated effort, attackers drained over 90% of LuBian’s Bitcoin holdings. Blockscope’s transaction tracer vividly reveals the complex web of multiple receiving addresses capturing the stolen funds. Two days later, a secondary loss occurred, with an additional $6 million in Bitcoin (BTC) and Tether (USDT) drained from wallets associated with the Bitcoin Omni Protocol.

Blockscope Tracer shows outflow of funds from LuBian wallet to more than 350+ addresses.

By December 31, LuBian desperately attempted damage control, sequestering 11,886 BTC into recovery wallets. Operations ceased almost immediately, marking the end of LuBian’s short-lived prominence. ### Pleas Ignored: LuBian’s On-Chain Appeals In a dramatic, yet ultimately futile, effort, LuBian publicly attempted to communicate with the thief via blockchain messages embedded in transactions. Between 2022 and 2023, LuBian embedded more than 1,500 OP\_RETURN messages, spending approximately 1.4 BTC to appeal directly to the attacker. This unusual method offered transparent proof of distress and rightful ownership, yet all pleas went unanswered.

https://mempool.space/tx/401b3ba83369d507a091cc54d7625dbb5050c4d249ed833624ff9a3666cd379f

### The Quiet Dormancy of Stolen Wealth Remarkably, most of the stolen 127,426 BTC remain largely dormant to this day, with only minimal activity indicative of strategic, long-term storage. The last significant activity was observed in 2024, characterized by funds consolidation. Blockscope’s clustering analysis has linked over 2,200 addresses across LuBian’s compromised wallets and the attacker’s network, showcasing classic consolidation patterns spanning from 2020 to 2025.

## Why Such a Massive Theft Stayed Hidden Several factors contributed to the prolonged invisibility of this theft: * **Opaque Pool Operations:** Limited transparency and external telemetry due to privacy practices and geographic considerations. * **Absence of Breach-Disclosure Norms:** Unlike traditional finance, cryptocurrency mining pools lack mandatory reporting frameworks for breaches. * **Dormancy of Funds:** Without immediate cash-out attempts, traditional exchange controls and detection mechanisms were never triggered. * **Fragmented Intelligence Sharing:** Back in 2020, cross-organizational sharing of Indicators of Compromise (IOCs) lacked standardization and urgency. ## How Blockscope Can Prevent Future “LuBian” Events To address such gaps and prevent similar incidents, Blockscope employs advanced blockchain monitoring and forensic tools: * **Watchtower & Security Monitoring:** Real-time detection of unusual treasury withdrawals, behavioral analysis of operations, and proactive alerts. * **Cross-chain Correlation:** Multi-hop tracing capabilities to detect attempts at obfuscation. * **Cluster Mapping:** Detailed visualizations linking thousands of addresses associated with an attacker’s network. * **Forensic Message Analysis:** Tools to interpret embedded transaction messages (e.g., OP\_RETURN), creating a clear provenance of theft. * **Legal Liaison:** Packages ready for law enforcement with clear evidentiary trails suitable for subpoenas and court processes. ## Conclusion: A Wake-Up Call for Crypto Security The LuBian incident demonstrates how scale, silence, and weak security practices can effectively conceal even multi-billion-dollar thefts. For compliance professionals and law enforcement agencies, the directive is unmistakable: integrate robust on-chain telemetry as a fundamental security control, enforce rigorous key management practices, and standardize breach disclosures. The industry must aim to prevent the next "LuBian" rather than discover it five years too late. #### **Author**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @ Blockscope ### For more information, please reach out to us: **E-mail**: **X**: [x.com/BlockscopeCo](https://x.com/BlockscopeCo) **LinkedIn**: [www.linkedin.com/blockscopeco](https://www.linkedin.com/company/blockscopeco)

**Disclaimer: Best effort work** This article represents Blockscope’s best-effort analysis based on blockchain data, on-chain forensics, and open-source information available at the time of writing. While we strive for accuracy, readers should note that blockchain data can contain discrepancies and may evolve. Our findings reflect our understanding as of August 3, 2025, and may change as new information emerges. # CoinDCX Breach: Unmasking the Multichain Heist

## Summary [On July 19, 2025, CoinDCX experienced a severe security breach](https://t.me/investigations/264) on the Solana blockchain, resulting in the loss of approximately $44.2 million in cryptocurrency assets, primarily USDT. This occurred due to a sophisticated server-side breach that allowed attackers to exploit internal operational wallets. The attackers swiftly moved these funds to Ethereum, complicating recovery efforts. But what initially appeared as a straightforward hack was, in fact, a complex, multichain setup. [CoinDCX](https://coindcx.com/), an Indian cryptocurrency exchange established in 2018, became aware of the breach after blockchain analyst [ZachXBT](https://x.com/zachxbt) raised alarms, following an alert from [Cyvers](https://x.com/CyversAlerts). CoinDCX officially acknowledged the incident approximately 17 hours after the breach was identified, reassuring users that customer funds were secure, stored separately in cold wallets.

CoinDCX Co-Founder Sumit Gupta acknowledging the exploit after several hours

## Major Addresses and Transactions Primary Exploiter (Solana): `6peRRbTz28xofaJPJzEkxnpcpR5xhYsQcmJHQFdP22n` Exploiter (Solana): `3btch8cSVp3Uh2SiY9DeiRNYUBmFiBNHZQzDyecJs7Gu` Funder Wallet (Ethereum): `0x23d872d2c091438085253787a5c60dc22e6c8c88` Exploiter (Polygon): `0x03cd775859dd64ef956d9f4ebcb45e3d6e355657` Eth Holder Wallet (Ethereum): `0xef0c5b9e0e9643937d75c229648158584a8cd8d2` ## Decoding the Exploit The breach was not a smart‑contract failure but an off‑chain security lapse. In the early hours of July 19, a single liquidity‑provision wallet, used to keep markets liquid, was compromised after attackers obtained server‑level access. Within thirty minutes, the exchange’s internal monitors detected abnormal withdrawals and isolated the affected infrastructure by 04:00 a.m., [as reported by CoinDCX](https://x.com/CoinDCX/status/1947625144379445682), preventing lateral movement to other operational wallets. Internal evidence points to a compromised credential or mis‑configured access policy on the host that signed transactions for the hot wallet. With that foothold, the attackers could sign arbitrary transfers, bypassing on‑chain permission checks. Luckily, no customer funds were ever at risk because the cold‑storage layer requires multi‑party authorisations, a control the attackers could not satisfy. ### A Three‑Day Multichain Warm‑Up * **July 16** – The operation begins with a 1 ETH withdrawal from Tornado Cash that is immediately swapped on FixedFloat, parked briefly on Polygon, and then bridged to Solana via deBridge. This cross‑chain hop primed Solana wallets with SOL for fees and signalled the attacker’s intent to blur provenance across ecosystems. * **July 17** – Infrastructure rehearsal. Nodes, proxy servers, and burner wallets are spun up; small dust movements confirm connectivity while the attackers finalise targets. * **July 18** – A 1 USDT “test” transfer is pushed from the compromised wallet, an on‑chain canary confirming the private key has been fully hijacked and the route back to Tornado Cash is clear. At 22:09 UTC on July 18**,** the siphoning starts. In just five minutes, the attackers execute a sequence of high‑velocity withdrawals, each signed from the same hot wallet, draining roughly $44 million in USDT. Small follow‑up transactions in USDC and USDT sweep residual balances and close the on‑chain loop. Because internal alerting triggered quickly, only a single wallet was drained. All other liquidity wallets were rotated, API keys revoked, and outbound bridges black‑holed. The attackers, however, had already bridged much of the loot back to Ethereum and begun layering via mixers. In short, what looked like a simple private‑key theft was the finale of a carefully choreographed multichain campaign spanning **Tornado Cash →Ethereum →FixedFloat →Polygon →deBridge →Solana →Multiple Bridges →Ethereum**—a playbook reminiscent of state‑sponsored crews who favour long staging windows and surgical execution. ## On-Chain Activity Upon notification by ZachXBT, our team swiftly initiated an extensive backward trace of the stolen funds, starting from Ethereum Wallet `0xef0c5b9e0e9643937d75c229648158584a8cd8d2` . Utilizing Blockscope’s proprietary Tracer tool, the team successfully reconstructed the cross-chain journey of the stolen assets, starting from Ethereum, tracing back to Solana, Polygon, and finally originating again from Ethereum through various protocols like deBridge, Mayan Finance, and FixedFloat. Due to Blockscope’s current limitations in supporting Solana chain visualization, specific Solana activities were documented externally using open source explorers.

Tracer maps the entire CoinDCX exploit across EVM chains in detail

## Timeline and Breakdown ### **July 16, 2025 at 1**:43 UTC Initial funding from Tornado Cash 1 ETH pool to the Exploiter address `0x23d872d2c091438085253787a5c60dc22e6c8c88`, which funnels the funds through two hops before depositing them into Fixed Float. Funding Tx. : `0x8d15cd638675131e40a307e1ec01588f0522f247377151ec1490bab7159cfa99`

### **July 16, 2025 at 2**:09 UTC Polygon Exploiter address `0x03cd775859dd64ef956d9f4ebcb45e3d6e355657` receives funds from FixedFloat from Ethereum in two transactions, which are eventually bridged to Solana. Using Transaction Decoder and [deBridge Explorer](https://app.debridge.finance/orders?s=0x05db2207a176dc71b4156ab04da2f2b551215cbf46f91e02e0b40b695128c979), we were able to find the recipient address on Solana: `GVkoTBDBg9u3PFmgG6rapcizkEg6Bhfk6tBfJqugdFcS` Tx: hashes: • `0x90083b839d093536104efb592aa46847993dca26a9410faac99aad4ec236f41b` • `0x5134ceaabe24a65512c7641849bf3088da151dbbda5bbd499c1a693e7a0c4467`

Tracer indicates that the funds initially landed on Polygon and were subsequently bridged to Solana.

Using Transaction Decoder tool and deExplorer, we were able to trace the receiver address on Solana

### July 16, 2025 at 2:22 UTC Solana Funder Address `GVkoTBDBg9u3PFmgG6rapcizkEg6Bhfk6tBfJqugdFcS` starts to fund the Primary Exploiter Address `6peRRbTz28xofaJPJzEkxnpcpR5xhYsQcmJHQFdP22n` .

On-chain data confirms that wallet `GVkoTB...` received funds through two incoming transactions from deBridge and immediately transferred them to the primary exploiter.

### July 18, 2025 at 21:07 UTC The exploit began with a test transaction involving just 1 USDT, likely to confirm full access to the exchange wallet `Ge8dzF234QHZKFh7TYyZqdipn3BoHyZfoyz9fxEqdTRi`. Once access was verified, the exploiter proceeded to drain large sums from the wallet. The stolen funds were then swapped and bridged to Ethereum through deBridge and Mayan Finance, effectively moving them off the original chain. Test Tx: `5KN91UvSLNR3ygAvXiRRyPofnzDFawT9rxbxSfdg6bai1WwbDizv5nM1etWPR2m7Rg4vTrLmXLEy6CSPcDjGJBQQ`

A series of outflows from the exchange wallet led to the depletion of approximately $45 million in assets.

### July 18, 2025 at 22:50 UTC Bridged funds from Solana were received on Ethereum and were deposited into multiple intermediaries, eventually consolidating in one wallet `0xef0c5b9e0e9643937d75c229648158584a8cd8d2` . As of July 23, all the funds of the exploit are being held by this address on Ethereum.

## Monitoring Blockscope continues intensive real-time monitoring of the Exploiter's wallet `0xef0c5b9e0e9643937d75c229648158584a8cd8d2` , currently holding all the funds. Observations and insights are continuously updated on Blockscope’s public watchtower. Link:

Wallet Profiler shows all the funds resides on one address on Ethereum

## CoinDCX & WazirX: Echoes of Lazarus Group? The striking similarities between the CoinDCX breach and last year’s [WazirX incident](https://research.blockscope.co/blockscope-wazirx-235m-exploit-investigation), both marked by sophisticated intrusions, precise execution, and extensive cross-chain obfuscation, raise serious concerns. Notably, both attacks occurred on the same date, an unusual coincidence that adds to the intrigue. Given the advanced tactics employed in both cases, the potential involvement of North Korea’s Lazarus Group, a threat actor infamous for cyber-espionage and high-profile crypto heists, remains a credible and concerning possibility. Security firm[ Cyvers has also highlighted ](https://cyvers.ai/blog/5-minutes-44m-coindcx-hack-shows-all-the-signs-of-lazarus-involvement)these attack methodologies as indicative of Lazarus Group's known modus operandi, strongly suggesting a targeted focus on India's major cryptocurrency platforms. Enhanced preemptive threat prevention strategies are now essential, as these incidents serve as dire warnings rather than isolated events. ## Conclusion CoinDCX’s response, issued shortly after ZachXBT’s public disclosure, appeared more reactive than coordinated, suggesting internal uncertainty rather than clear communication. The potential involvement of North Korean state-sponsored cyber actors underscores not only a financial risk but also a broader security concern for India's cryptocurrency ecosystem and the global digital asset landscape. To mitigate such threats, exchanges must prioritize robust internal security protocols, implement real-time blockchain monitoring, and actively collaborate with cybersecurity experts. **Investigation by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Forensics Analyst @ Blockscope For more information, please reach out to us at ****

## 1. Introduction The first half of 2025 has proven challenging for the blockchain and cryptocurrency ecosystem, characterized by fewer but significantly more devastating security incidents. Although the number of crypto crime incidents slightly decreased compared to previous years, financial losses have surged dramatically, reaching an unprecedented total of approximately $2.4 billion (Reflecting only major hacks, exploits, and large-scale breaches). APT (Advanced Persistent Threat) groups and organized cybercriminal networks have employed advanced and modular attack techniques, resulting in substantial asset losses and significantly impacting user trust and confidence. This evolving threat landscape has been marked by increasingly complex scams, phishing, social engineering attacks, and other exploitative tactics. Notable emerging threats include deepfake-enabled fraud, targeted social engineering scams, and highly sophisticated "address poisoning" attacks, underscoring the adaptability and innovation of malicious actors within the crypto space. In response to these rising security challenges, Blockscope has established itself as an essential ally to law enforcement, regulatory bodies, exchanges, and individual investors. With cutting-edge blockchain forensics, real-time transaction monitoring, and its advanced AI Investigator platform, Blockscope significantly enhances the ecosystem's capabilities to swiftly identify, investigate, and mitigate emerging threats. This report utilizes Blockscope’s analytical insights to deliver a comprehensive overview of the crypto crime and blockchain security landscape, providing industry stakeholders with critical intelligence and actionable recommendations to protect digital assets and uphold ecosystem integrity. ## 2. State of crypto crime in 2025 The first half of 2025 has been challenging for crypto and blockchain security, with losses due to hacks, exploits, and security incidents spiking to nearly $2.4 billion. Although the second quarter witnessed a decline in the number of hacks, the financial severity of these incidents remained high. Ethereum experienced the largest share of these losses, amounting to approximately $1.7 billion, largely driven by the Bybit breach in February. Phishing remained a prominent threat in 2025, resulting in approximately $420 million in losses from over 130 major incidents. Additional fraudulent activities, such as Social Engineering Attacks, Address Poisoning, Deepfakes, ATM Scams, and Pig Butchering schemes, continued to significantly impact both novice and seasoned crypto users, highlighting the evolving tactics employed by malicious actors.

First six months losses in 2025 due to Crypto Exploits

### 2.1 Crypto Exploits in the First Half of 2024 vs 2025 The first half of 2025 marked a significant and concerning escalation in cryptocurrency-related losses. While H1 2024 saw approximately 223 incidents resulting in around $1.43 billion in losses, H1 2025 recorded fewer major incidents (around 120-144, though total security incidents were higher at 344), yet the total financial impact surged to approximately $2.47 billion. This represents a staggering 65% increase year-over-year and highlights a trend towards fewer but substantially larger "whale" hacks, with the average loss per incident jumping from about $3.1 million in H1 2024 to $7.18 million in H1 2025. The dramatic increase in 2025's losses was primarily driven by two colossal breaches: the unprecedented Bybit hack in February, which alone accounted for roughly $1.4 billion in stolen assets (making it the largest crypto theft ever and likely tied to the Lazarus Group), and the Cetus Protocol incident in May, involving a $225 million loss (though $162 million was recovered).

Metric	H1 2025	H1 2024
Total Incidents	~120-140	~223
Total Losses	$2.4 billion	$1.43 billion
Largest Exploit	Bybit Hack (~$1.4 B)	DMM Bitcoin (~ $304 M)
Attack Vectors	Wallet Compromise, Phishing Attacks	Private Key Compromises, Phishing Attacks

## 3. Key Trends and Analysis In the first half of 2025, the cryptocurrency ecosystem witnessed a notable shift in attack patterns. Decentralized Finance (DeFi) protocols continued to be a frequent target, accounting for approximately 92 reported incidents and around $470 million in losses. This highlights persistent vulnerabilities within smart contracts, governance mechanisms, and the need for more rigorous security audits in the DeFi space. However, Centralized Exchanges (CEXs), despite experiencing fewer incidents (around 11 reported cases), suffered disproportionately higher financial losses, totaling approximately $1.88 billion. This indicates that while CEXs might be harder to breach, successful attacks on these platforms yield significantly larger payouts due to their vast liquidity and centralized infrastructure, making them high-value targets for sophisticated actors, including state-sponsored groups. The most financially impactful attack type was wallet compromises, which alone resulted in approximately $1.7 billion in stolen assets across 34 incidents. These breaches often stem from compromised private keys or inadequate wallet management practices. Phishing and other social engineering-based attacks continued to affect users heavily, reinforcing the human vulnerability in crypto security. Furthermore, new social engineering techniques like "ClickFix" attacks (A phishing tactic where users are tricked into clicking a fake “fix” button, which silently grants hackers access to their wallet or tokens) saw a rapid surge, becoming a significant threat alongside other persistent fraudulent activities such as rug pulls, ATM scams, and pig butchering schemes. This evolving threat landscape emphasizes the critical need for both robust technical security and enhanced user education. ### 3.1 Major Exploits and Security Incidents As previously mentioned, while DeFi protocols experienced the highest number of incidents, centralized exchanges (CEXs) were responsible for the largest share of total losses. The Bybit cold wallet breach in February 2025 alone accounts for approximately 60% of all losses so far this year, representing a single-point failure that dramatically influenced the overall numbers. The second largest exploit was the Cetus Protocol breach, which occurred in May 2025 and resulted in an estimated loss of $223 million. Blockscope conducted thorough investigations into both the [Bybit Hack](https://research.blockscope.co) and the[ Cetus Protocol Exploit](https://research.blockscope.co/cetus-protocol-exploit-analysis).

Blockscope Tracer visualizing the May 2025 Cetus Protocol exploit, showing the exploiter receiving bridged funds from SUI to ETH.

Without these two significant incidents, total losses for 2025 would stand at around $690 million, indicating that the broader trend may not be as severe as the headline figures suggest. Together, the top 10 largest attacks of H1 2025 collectively caused approximately $2.02 billion in losses, highlighting the outsized impact of high-profile breaches on the ecosystem’s overall security posture.

Top 10 Crypto Exploits in H1 2025 (Ranked by Funds Lost)

### 3.2 Rare and Unique Exploits Beyond the high-value incidents, H1 2025 also saw several unique and noteworthy exploits that highlight emerging vulnerabilities and sophisticated attack methodologies. 1\. The [**SIR Protocol Exploit**](https://research.blockscope.co/sir-protocol-exploit) was a rare incident stemming from the improper handling of transient storage, specifically leveraging nuances within [EIP–1153.](https://eips.ethereum.org/EIPS/eip-1153) This technical vulnerability allowed attackers to manipulate temporary data storage, leading to unauthorized operations and highlighting the complexities of new EIP implementations.

The attacker exploited the improper handling of Transient Storage (EIP-1153) of the SIR Vault

Blockscope Cluster Analysis shows various tokens and contracts being created and controlled by the Exploiter

2\. The [**Nobitex Hack**](https://research.blockscope.co/notibex-hack) in June 2025 stands out due to its geopolitical nature, as an Israeli hacker group [Gonjeshke Darande](https://x.com/GonjeshkeDarand) attacked Iran's largest crypto exchange, [Nobitex](https://nobitex.ir/), resulting in an estimated $82 million loss. This incident involved not only financial theft but also a breach of the exchange's infrastructure, highlighting a new dimension of state-affiliated cyber warfare in the cryptocurrency space.

Hackers exploited Nobitex across multiple chains using vanity addresses. Blockscope Tracer visualizes the token transfers on multiple networks in a single unified graph.

3\. A sophisticated [**EIP-7702 Phishing Attack**](https://www.binance.com/en/square/post/24748390118281) on May 24, 2025, led to a user loss of $146,551, orchestrated by the Inferno Drainer group. This rare phishing method exploited the[ EIP-7702](https://eip7702.io) contract delegation mechanism by tricking users into authorizing a legitimate MetaMask EIP-7702 Delegator. This allowed for bulk token approval phishing operations, bypassing many traditional anti-phishing tools focused on transfer blocking, and revealing new risks associated with delegation, such as private key leakage and multi-chain contract code inconsistencies. ## 4. Crypto Crime Tactics Beyond large-scale hacks and exploits, scams aimed at deceiving individual users remain a persistent and rapidly evolving threat in 2025. Throughout this year so far, a range of sophisticated fraud tactics has continued to drain millions in user funds by exploiting gaps in knowledge, trust, and digital security habits. From address poisoning to romance scams and deepfake-driven tricks, these scams show how quickly crypto criminals adapt. The following sections highlight the most notable fraud methods shaping the crypto crime landscape in the first half of 2025. ### 4.1 Address Poisoning Address poisoning is a scam tactic where attackers send zero-value transactions from wallet addresses that closely resemble a victim’s trusted recipient address, often differing by just a few characters. These spoofed addresses appear in the wallet’s transaction history, tricking users into mistakenly copying and sending funds to the attacker’s address. This method has remained a persistent and costly scam in 2025, exploiting user habits and transaction history features across blockchains like Ethereum. Recent on-chain research and security reports estimate that address poisoning has led to over $83 million in reported losses so far this year, affecting both individual users and institutional wallets. In May 2025, a significant address poisoning case came into light where a trader (0x86c0…)[ accidentally transferred approximately $2.6 million to a scammer address](https://x.com/BlockscopeCo/status/1928535894874603947) due to multiple spoofed zero-value transactions. The fraudster generated numerous vanity addresses similar to the intended recipient’s, flooding the victim’s transaction history to confuse the sender. Using Blockscope’s Tracer tool, our team mapped the victim’s transaction flow, revealing a clear pattern of spoofing and redirection that made the scam possible.

Blockscope Tracer visualizes the incident, clearly showing how the scammer received the $2.6M instead of the genuine recipient.

Blockscope Wallet Profiler detects multiple vanity addresses used to spoof and confuse victims.

**X**** Red flags** Unexpected zero-value transactions to lookalike addresses appearing in wallet histories. ✅**Solutions** To prevent this type of fraud, Blockscope recommends verifying recipient addresses carefully before signing transactions. Our Wallet Profiler can flag suspicious recipient wallets and provide risk scores, while our Transaction Simulator helps institutions test and confirm transaction paths before funds are released. As always, crypto users should double-check copy-pasted addresses and avoid relying solely on transaction history when sending high-value transfers.

Wallet Profiler provides you with the risk score of a wallet, frequently interacted counterparties' information, along with all transaction history and holdings.

### 4.2 Pig Butchering Pig butchering, or "Sha Zhu Pan," is a hybrid romance and investment scam and one of the most common crypto crime strategies being used today. It is often run by organized syndicates, who pose as romantic partners to lure victims into fake crypto "investments." According to[ the UNODC 2025 report,](https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf) the scam has spread far beyond Asia and fuels an estimated $64 billion in global losses each year.

New[ FTC data](https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024) shows reported fraud losses in the US jumped to $12.5 billion in 2024, with investment scams - mainly crypto pig butchering - being the top category for consumer financial losses. Early 2025 figures show the trend remains strong, with victims being groomed for weeks through dating apps and "wrong number" messages, only to lose everything when fake investment sites block withdrawals and demand fake "taxes." The rise of AI and deepfake technology has made scams like pig butchering, impersonator scams, and fraudulent investment schemes much easier for criminals to execute. Use of AI deepfake generators, deepfake video calls, AI-generated KYC documents, etc., has contributed a lot to these scams.

Scammers now use deepfakes to impersonate public figures or officials—like fake FBI agents or Elon Musk videos, defrauding millions every year.

Increasingly, these scams are used in combination—for example, pig butchering often leads victims to invest in fake crypto projects or Ponzi schemes. Deepfake video calls and realistic AI-generated personas can convince victims they are speaking with a real person, strengthening trust and making romance scams even more convincing and difficult to detect. Initiatives like [Operation Level Up by the FBI](https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/operation-level-up) and[ Operation Shamrock](https://operationshamrock.org) by ex-law enforcement professionals help educate the public on how to spot scams and where to report them. As per the FBI, Operation Level Up, which started in January 2024, has so far notified nearly 6000 victims about the investment fraud, and as per an estimate in April 2025, has saved nearly $359 million in losses. **X**** Red flags** Indicators for pig butchering include sudden unsolicited messages from strangers who quickly become friendly and romantic, then pitch crypto or investment opportunities. Watch for new users sending large payments to unknown wallets, or small returns that mimic genuine profits. Also, be wary of any destination wallet connected to known laundering hubs like Huione Pay, Haowang Guarantee, or other scam-linked services.

A random email or a DM on Telegram or WhatsApp can often be the entry point for a pig butchering scam. Being part of an “investment group” that repeatedly asks for taxes or fees to release your funds is another major red flag.

✅**Solutions** The best solution is awareness, helping people recognize these scams and spot red flags early. Companies like Blockscope play a vital role by detecting suspicious transaction patterns and tracing address histories linked to known fraud clusters. If someone interacts with an entity directly or indirectly connected to an illicit network, Blockscope’s analytics tools can alert users and institutions in real time. In addition, public scam URL repositories like [Better Business Bureau](https://www.bbb.org/scamtracker),[ ScamSmart](https://www.fca.org.uk/scamsmart),[ Chainabuse](https://chainabuse.com/?utm_source=xinquji), and[ ScamShield](https://www.scamshield.gov.sg) provide up-to-date lists of fake sites, making it easier for users and investigators to block scams before funds are lost. ### 4.3 Social Engineering In the first half of 2025, social engineering attacks remained one of the biggest threats to crypto security, proving once again that no sophisticated technology can fully protect against the “human factor.” From high-profile incidents like the[ Bybit cold wallet breach](https://research.blockscope.co) to the recent[ Coinbase data leaks](https://www.coinbase.com/en-ca/blog/protecting-our-customers-standing-up-to-extortionists), many of this year’s largest losses have roots in well-planned social engineering campaigns. A striking example is the wave of attacks targeting Coinbase users. Attackers bribed overseas customer support contractors to leak KYC information, including names, addresses, and emails—data that later enabled precise, highly realistic scams. Victims received calls from spoofed official numbers, fake support emails, and SMS messages pushing them to transfer assets into “secure wallets” allegedly for protection. The twist: scammers often provided pre-set wallet seed phrases, tricking users into building new wallets secretly controlled by criminals. By mid-2025, the FBI and DOJ confirmed that Coinbase users had lost over $100 million through this single chain of attacks, many traced back to organized groups connected to Indian fraud networks and COM sphere actors.

An example of a fake Coinbase support email, along with Coinbase’s official response addressing the incident

Similarly, the massive[ Bybit hack also points to social engineering as a root cause](https://www.csis.org/analysis/bybit-heist-and-future-us-crypto-regulation). Early reports suggest that attackers exploited a developer’s machine, gaining internal access privileges and insider connections to bypass security barriers and extract private key fragments, resulting in the theft of over $1.4 billion in cryptocurrency in one of the largest single-exchange breaches ever recorded.

Safe Wallet confirmed that the Bybit hack began with a compromised signing machine exploited via social engineering. Source: @Safe

A typical attack of this kind targets the social surface - the human factor. Even with the best cybersecurity systems and due diligence programs, people remain one of the most vulnerable points, making these attacks possible. **X**** Red Flags** Unexpected calls, emails, or DMs claiming your account is at risk and pushing you to act quickly—especially if they tell you to transfer funds or share seed phrases—are clear warning signs. Any message that asks for pre-set wallets or private keys is always a scam. Be extra cautious with emails, too: during the Coinbase data leaks, scammers used emails verified by Google to appear legitimate, showing that individual caution and scrutiny are still your strongest defense. ✅**Solutions** For individual users, the best defense is awareness: any official support of an exchange or custodian will never ask for keys or direct wallet transfers. On the institutional side, unchecked staff access to customer data remains a major vulnerability. Firms must tighten internal permission controls, monitor employee access, and train teams to recognize bribery attempts and suspicious outreach. Leveraging AI-driven phishing detection and stronger audits can help reduce the human factor risks that make these attacks possible. ### 4.4 Phishing Scams Phishing remains one of the most persistent and costly threats in crypto security. These scams aim to trick victims into giving up sensitive information - login credentials, private keys, or seed phrases - or, in more advanced forms, deploy malware to compromise devices and wallets. Attackers often impersonate trusted sites, support teams, or project channels with near-perfect copies. Sometimes the only clue is a small change in the URL, like swapping a single character or using an unusual top-level domain (.info, .xyz). As per [Forbes](https://www.forbes.com/sites/glenngow/2024/07/14/ais-double-edged-sword-managing-risks-while-seizing-opportunities/), since the launch of ChatGPT, attacks that leverage AI have risen by 1,265%.

In 2025, phishing has evolved far beyond fake login pages. Attackers now hijack real social media accounts and websites, push fake airdrops through verified channels, or manipulate dApp interfaces to prompt victims to sign malicious transactions. One example is ice phishing, where a user unknowingly grants smart contract permissions that allow attackers to drain funds later. We have seen multiple cases this year where scammers used fake staking sites and malicious contract approvals to drain assets through hidden [ice phishing](https://www.microsoft.com/en-us/security/blog/2022/02/16/ice-phishing-on-the-blockchain/) traps.

Cointelegraph acknowledged that their website was compromised and exploited by attackers to promote fake ICOs and airdrops. Source: Coincentral

The financial losses from phishing attacks can be severe and wide-ranging. In late April 2025,[ ZackXBT reported that an elderly victim lost 3,520 BTC](https://x.com/zachxbt/status/1916756932763046273), worth around $330 million, to a social engineering scam run by a call center group based in the United Kingdom.

Another notable case, aforementioned in Section 3.2, shows how phishing now exploits new technical standards too: on May 24, a [victim lost $146,551 ](https://www.binance.com/en/square/post/25053481458513)when the phishing group Inferno Drainer abused MetaMask’s EIP-7702 Delegator feature to carry out bulk token approval phishing without switching the victim’s address. Overall, while EIP-7702 expands what wallets can do, it also introduces new risks. Users must carefully understand who they’re authorizing and exactly what permissions they’re granting before signing any delegation. #### 4.4.1 LinkedIn Recruitment Phishing Since early 2025, scammers have increasingly exploited LinkedIn’s professional trust to target engineers with fake job offers from bogus blockchain projects. They present convincing project overviews, share detailed design drafts, and offer technical lead roles to gain trust. After initial calls and interviews, victims are asked to download a “technical test” from a shared repository, but hidden in the code is an encrypted payload that installs a backdoor. Once active, this malware quietly steals sensitive data like SSH keys, wallet mnemonics, and browser extensions, putting crypto assets at high risk. For example, one victim found harmless‑looking files like error.js that hid extra lines of encrypted code. This hidden script copied sensitive data using Python — or a fallback bash script — silently draining keys and credentials once run. These attacks are difficult to detect at first, making careful code reviews and testing in secure, isolated environments critical when dealing with unfamiliar recruiters or projects.

Random DMs like this often lead to a call, and in many cases, the scam ends with you running malicious code on your machine as a so-called pre-requisite test.

These incidents highlight how both classic social tricks and new smart contract features can be misused if victims don’t carefully verify what they’re signing or approving. **X**** Red Flags** Signals for phishing or scam attempts in the crypto space include suspicious or lookalike URLs, especially those using unusual domains like `.info` or `.xyz`, designed to mimic legitimate crypto platforms. Users should also be wary of unsolicited requests for login credentials, private keys, seed phrases, or wallet backups. Generic greetings such as “Dear User” instead of personalized names, along with fake support emails or direct messages that create urgency or threaten account suspension, are common tactics. These scams may also push victims toward private communication apps like Telegram. Another red flag is transaction prompts that don’t clearly show the permissions being granted, often a sign of potential *ice phishing*. Additionally, some attackers exploit professional platforms, sending fake job offers on LinkedIn that ask candidates to download or run unverified code as part of a so-called technical test. ✅**Solutions** Always verify URLs using trusted tools and consider bookmarking official crypto websites for future logins. Be especially cautious of messages that pressure you to act quickly, share sensitive information, or click suspicious links. Before signing any transaction, take a moment to double-check the details and consider using transaction simulators for extra safety. If you're asked to run unfamiliar code—for example, in a job-related context—do so only in a secure, isolated environment, never on a device connected to your primary wallet. Tools like Blockscope’s Wallet Profiler and Tracer can help detect risky addresses, fake sites, and malicious approval flows linked to phishing campaigns. Finally, companies should implement strong spam filters, regularly train staff to recognize phishing attempts, and ensure customers can easily verify any unusual requests through official support channels. ### 4.5 ATM Scams Crypto ATMs remain a popular tool for scammers due to their speed, ease of use, and gaps in regulation in many regions. While some countries have tightened KYC and reporting rules, the anonymity these machines offer still makes them an easy on-ramp for fraud and money laundering. Criminals often pose as government officials, utility company representatives, or tech support agents, pressuring mostly elderly or vulnerable victims to urgently pay fines, bills, or “protect” their money using a crypto ATM.

A crypto ATM accompanied by a warning advising users to stay alert and avoid scams.

Moreover, non-KYC crypto ATMs often serve as an easy obfuscation layer for criminals, enabling them to quickly convert cash into crypto with minimal traceability. This loophole makes ATMs a common tool for various scams, from romance fraud and pig butchering to sextortion and fake investment schemes. Scammers favor ATMs because victims can deposit funds rapidly, often under pressure, and the lack of strong identity checks means these transactions are harder for banks and law enforcement to flag in real time. Organizations like the FBI, IC3, and FTC continuously[ warn the public about these tactics](https://www.ic3.gov/PSA/2021/PSA211104) and urge people to think twice before sending money through a crypto ATM. Recent figures highlight the scale of the problem.[ The U.S. FTC reported losses of around $65 million](https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2024/09/bitcoin-atms-payment-portal-scammers) linked to crypto ATM scams in just the first half of 2024, mostly tied to government and business impersonation frauds.[ Australian Federal Police (AFP) recorded over AUD 3.1 million ](https://www.afp.gov.au/news-centre/media-release/3-million-lost-cryptocurrency-atm-scams-12-months-may-be-just-tip-iceberg)(\~USD 2.1 million) in ATM scam losses in the past year, with elderly victims making up a large share. Some recent cases include victims paying tens of thousands through ATMs after being threatened with arrest warrants, fake fraud investigations, or fake bail demands for family members. In a notable UK incident, law enforcement even [cut open a Bitcoin ATM to recover nearly USD 32,000](https://www.tomshardware.com/tech-industry/cryptocurrency/authorities-saw-open-bitcoin-atm-to-recover-scammed-money-almost-usd32-000-seized-from-machine) that a victim had deposited to scammers.

Police saw open Bitcoin ATM to recover $32,000 in scam funds; Source: Cointelegraph

**X**** Red flags** For ATM fraud, include new or elderly users making large, one-off ATM deposits, payments just under reporting thresholds, and stories that create urgency and fear. Scammers often demand payment specifically through crypto ATMs to avoid bank traceability and exploit the lack of real-time oversight. ✅**Solutions** The best defense is a mix of stronger due diligence, public awareness, and real-time monitoring. ATM operators and VASPs should share scam patterns and use tools like Blockscope’s Security monitoring to flag addresses that repeatedly receive funds from different ATMs. Many jurisdictions, including parts of the U.S. and Australia, are also setting limits on how much new users can deposit or withdraw via ATMs — an important step in protecting vulnerable groups. Most importantly, people should remember that no legitimate government agency, utility company, or bank will ever ask for payment through a crypto ATM.

Blockscope Security Monitoring helps to create custom risk rules for compliance and risk control.

## 5. Threat Actors Landscape The crypto threat actor landscape in 2024 and H1 2025 is dominated by two forces: state-sponsored hacking groups and large, profit-driven crime syndicates. Both have scaled rapidly, using AI-powered phishing, deepfakes, and precise social engineering to steal ever-larger sums. Organized crime rings drive the surge in pig-butchering, romance fraud, and mass phishing. [The FBI’s IC3 logged US$4.57 billion in crypto investment-scam](https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf) losses for 2023- the single largest fraud category - and early 2025 indicators show the curve still rising. The latest[ UNODC brief puts annual revenue from Southeast-Asian scam compounds at ≈US$64 billion](https://www.unodc.org/roseap/uploads/documents/Publications/2024/TOC_Convergence_Report_2024.pdf), much of it laundered through opaque on- and off-chain channels. State actors, above all North Korea, remain the most damaging single players, striking DeFi protocols, bridges, and exchanges, and then washing funds through mixers and cross-chain swaps. One shadow payment hub that repeatedly surfaces in laundering flows is Huione Pay, now a key conduit for proceeds of pig-butchering, romance scams, and other crypto frauds. ### 5.1 Lazarus Group North Korea remains one of the most active and notorious state-backed crypto threat actors, targeting exchanges, DeFi protocols, and blockchain infrastructure with highly organized hacks and laundering networks. In the first half of 2025 alone, North Korean-linked clusters have been connected to some of the largest security breaches so far, including the [Bybit cold wallet breach ](https://research.blockscope.co)and the[ Phemex hot wallet exploit](https://research.blockscope.co/the-phemex-heist-multichain-innovation-or-securit). As per our data, North Korean actors have directly caused losses of more than $1.8 billion in various hacks and exploits so far this year in the crypto ecosystem.

Blockscope’s on-chain tracing and link analysis tools were able to identify wallet flows and laundering paths that connect funds siphoned from Bybit and Phemex back to addresses linked with prior North Korean operations, including exploits of BingX and Poloniex last year.

Blockscope Tracer connected the Bybit, Phemex, and BingX exploits by revealing overlapping addresses.

Following these discoveries, [the FBI confirmed that the Bybit theft](https://www.ic3.gov/psa/2025/psa250226), now estimated at over $1.4 billion, was carried out by North Korean hacking cells, likely involving the well-known Lazarus Group. These threat actors continue to rely on advanced phishing, insider recruitment, and malware to breach high-value targets, often using sophisticated laundering layers involving cross-chain bridges and mixing protocols.

Beyond direct hacks, North Korean clusters are also tied to cyberattacks, ransomware campaigns, and extortion schemes targeting crypto-rich businesses and critical infrastructure. In April this year, [Kaspersky revealed that the Lazarus Group has been running ‘Operation SyncHole,’](https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-new-lazarus-led-cyberattacks-targeting-south-korean-supply-chains) targeting at least six major South Korean firms in IT, finance, semiconductors, and telecom. The attackers combined website traps using watering hole tactics with exploits of one-day vulnerabilities in software to penetrate networks and escalate privileges. Then, they deployed malware, including ThreatNeedle, Agamemnon, SIGNBT, and related loaders, allowing Lazarus to maintain stealthy long-term access and expand inside internal systems.

On May 8, Taiwanese exchange[ BitoPro was hacked](https://www.theblock.co/post/356522/zachxbt-flags-suspicious-11-5m-outflows-from-bitopro-exchanges-hot-wallets-says-it-was-likely-exploited), losing around USD 11.5 million from hot wallets across multiple chains. The attack, triggered by sophisticated social engineering, mirrored tactics linked to Lazarus, including hijacked AWS session tokens and trojans planted on cloud operations staff. BitoPro’s investigation ruled out insider involvement and confirmed that quick emergency action prevented greater losses. Law enforcement agencies worldwide — including the FBI, OFAC, and partners across Asia — continue to issue public alerts, freeze stolen assets where possible, and sanction mixers and facilitators tied to these groups. In the Bybit hack, for example, eXch and Thorchain were used to launder much of the stolen funds. In many Lazarus-linked incidents, there is a consistent pattern of heavy reliance on bridges and protocols like Tornado Cash to obscure transaction trails and bypass sanctions.

Thorchain was one of the bridges used during the Bybit Hack

The table shows a spike in fee revenue of Thorchain, generated during Bybit Hack.

North Korea’s ongoing cyberattacks remain a global threat, not just to crypto but to industries and critical infrastructure worldwide. ### 5.2 Huione Group [Huione Pay](https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern) has emerged as a major underground payment channel driving Southeast Asia’s vast pig butchering and romance scam networks. Officially promoted as a payment and “guarantee” service under Huione Group, it operates heavily in Cambodia, where it is deeply connected with scam compounds that use forced labor to run large-scale online fraud operations. Victims are lured into fake relationships or crypto investments, then the stolen funds are routed through Huione Pay and affiliated accounts to move money across borders and obscure its origins.

Huione’s escrow arm, [Huione Guarantee](https://www.caci.com/darkblue/blog/unraveling-huione-guarantee-ecosystem), was pitched as a fraud-prevention layer, but, according to investigators and law enforcement agencies, often served to reassure victims while shielding operators. Crackdowns in 2024–25—including coordinated raids on scam compounds and wallet freezes—have increased pressure, yet the network’s scale persists: pig-butchering rings are still estimated to siphon tens of billions of dollars globally each year, underscoring how deeply entrenched Huione-style channels are in the fraud economy. ## 6. Artificial Intelligence: Threat and Opportunity The rapid adoption of Artificial Intelligence in crypto-crime has dramatically reshaped the threat landscape in the first half of 2025. AI-enabled tools such as deepfake videos, voice cloning, and malicious code generation have lowered barriers for criminals, leading to increasingly sophisticated and convincing scams. [Supply-chain poisoning through malicious AI plugins](https://mp.weixin.qq.com/s/wmmI_M0VyLnxoJX-7DV8Xg) emerged as a prominent threat this year. In a notable incident, a crypto startup lost hundreds of thousands of dollars after a developer unknowingly introduced malware through a pirated AI assistant tool ([Cursor](https://cursor.com/en)), purchased from an unverified vendor on Taobao. This malicious plugin implanted a backdoor, enabling attackers to inject unauthorized wallet addresses into smart contracts. Further investigation revealed a widespread issue: similar compromised packages, including sw-cur and aiide-cur, had affected over 4,200 developers, primarily on macOS systems.

Attackers used short-video platforms to divert traffic, luring victims into installing malicious AI coding plugins.

Another growing threat is the rise of[ “unrestricted” or "jailbroken" Large Language Models ](https://dl.acm.org/doi/10.1145/3699538.3699541)(LLMs), AI models deliberately modified to bypass safety restrictions and ethical boundaries. These models, available on underground forums, significantly reduce the technical expertise required to execute cyberattacks. Notable examples include: [WormGPT](https://abnormal.ai/blog/what-happened-to-wormgpt-cybercriminal-tools): An unrestricted variant of GPT-J, marketed explicitly for generating malware and phishing emails, with access available at low monthly fees.

[FraudGPT](https://abnormal.ai/resources/deep-dive-into-fraudgpt-webinar): A premium LLM designed specifically for scams, used extensively in generating fake crypto project materials, phishing pages, and tailored social engineering scripts. [GhostGPT](https://abnormal.ai/blog/ghostgpt-uncensored-ai-chatbot): Marketed as an ethics-free AI assistant, enabling attackers to craft sophisticated deepfake scams, fraudulent smart contracts, and malware variants designed to evade detection.

To counteract these emerging AI-driven threats, several recommendations are crucial for the crypto industry: * Strictly vet and install AI-related plugins and dependencies only from trusted sources. * Enhance phishing detection capabilities with AI-powered content and URL analysis tools. * Adopt advanced jailbreak-detection mechanisms, content watermarking, and traceability measures for AI-generated content. * Implement transaction simulation and explicit permission reviews before smart contract deployments and interactions. * Encourage industry-wide collaboration to quickly share indicators of compromise linked to AI-generated attacks. Despite these threats, AI also offers powerful defensive opportunities. Blockchain analytics companies increasingly use [AI to detect suspicious transactions](https://www.sunrisetechs.com/ai-fraud-detection-crypto-transactions/#:~:text=1.-,How%20does%20AI%20detect%20fraud%20in%20cryptocurrency%20transactions%3F,efficacy%20of%20crypto%20transaction%20monitoring.), identify complex laundering patterns, and proactively defend against fraud. AI-powered tools rapidly identify phishing emails, deepfake impersonations, and anomalous blockchain activities, significantly enhancing real-time monitoring and security measures. For instance, Blockscope employs its advanced AI Investigator tool to assist investigators and law enforcement agencies in rapidly tracing, clustering, and analyzing suspicious blockchain transactions. The effectiveness of this AI-driven approach was demonstrated in the recent[ ResupplyFi exploit](https://research.blockscope.co/resupplyfi-exploit), where complex attack transactions involving flash loans, multiple swaps, and cross-contract calls were rapidly analyzed and visualized by the AI Investigator. Similar advanced AI systems are leveraged by various blockchain analytics companies for real-time cross-chain token tracing and automated fraud detection.

Trace Call Analysis of the attack transaction of Resupply Exploit using Blockscope AI Investigator.

Ultimately, AI’s dual nature—as both threat and protective force—is inherent to its potential. While criminals leverage AI advancements to escalate fraud sophistication, firms like Blockscope are harnessing these same innovations to protect the crypto ecosystem, reduce investigative lead times, and enhance security across the industry. The ongoing challenge will remain adapting quickly and effectively, ensuring that AI technology stays firmly on the side of security and transparency. ## 7. Conclusion The first half of 2025 has highlighted both the resilience and adaptability of global crypto crime, as well as the increasing effectiveness of regulatory responses and investigative actions. Significant enforcement milestones, such as the [shutdown of eXch](https://www.presseportal.de/blaulicht/pm/7/6029813) following allegations of facilitating funds for the Lazarus Group, the [crackdown on Huione Pay](https://www.business-humanrights.org/en/latest-news/cambodia-huione-pays-banking-license-withdrawn-following-allegations-of-money-laundering-and-illicit-activities-including-facilitating-scams-incl-co-response/)'s extensive money-laundering operations linked to large-scale romance scams, and the disruption of Russian crypto exchange [Garantex](https://www.justice.gov/opa/pr/garantex-cryptocurrency-exchange-disrupted-international-operation), underscore the growing resolve of international authorities. These actions disrupted key networks that criminal groups rely upon to cash out illicitly obtained assets.

The German law enforcement splash page on eXch. Source: Presseporta

Yet, major challenges persist. Platforms such as Tornado Cash and similar mixers continue to provide critical infrastructure for cybercriminals and state-sponsored actors, notably those tied to North Korea, facilitating seamless cross-border fund obfuscation. Recent regulatory shifts further complicate these issues: On January 21, the U.S. District Court for[ the Western District of Texas revoked OFAC’s sanctions against Tornado Cash](https://cointelegraph.com/news/us-texas-court-reverses-tornado-cash-sanctions-crypto-privacy-win?utm_source=chatgpt.com), and on March 21,[ OFAC officially removed Tornado Cash](https://blog.ueex.com/crypto-lawsuits/tornado-cash-sanctions-litigation/?utm_source=chatgpt.com) and associated Ethereum addresses from its Specially Designated Nationals (SDN) list, reversing economic sanctions imposed since August 2022. Subsequently, on April 30, the Court issued a final ruling deeming Treasury Department sanctions on Tornado Cash unlawful, permanently preventing similar future actions. Additionally, the U.S. Department of Justice signaled a notable policy change on April 8,[ dissolving its National Cryptocurrency Enforcement Team (NCET)](https://www.reuters.com/world/us/us-justice-dept-disbands-cryptocurrency-enforcement-unit-2025-04-08/?utm_source=chatgpt.com) and ending its "prosecution in lieu of regulation" stance, as reported by Fortune magazine. These developments highlight the complex regulatory landscape and underline the ongoing need for cohesive international standards to effectively mitigate crypto-related threats. Encouragingly, swift on-chain tracing, emergency protocol freezes, and cross-border seizure orders have already [recovered or frozen](https://www.justice.gov/usao-dc/pr/largest-ever-seizure-funds-related-crypto-confidence-scams?utm_source=chatgpt.com) almost US$468 million in stolen crypto so far in 2025, spanning the Bybit, Cetus, and pig-butchering cases, plus smaller forfeitures in the United States. Sustained information-sharing between exchanges, analytics providers, and financial-intelligence units will determine whether the next six months tilt toward resilience or relapse. #### **Author**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Forensics Analyst @ Blockscope ### For more information, please reach out to us: **E-mail**: **X**: [x.com/BlockscopeCo](https://x.com/BlockscopeCo) **LinkedIn**: [www.linkedin.com/blockscopeco](https://www.linkedin.com/company/blockscopeco)

**Disclaimer: Best effort work** This report represents Blockscope’s best-effort analysis based on blockchain data, on-chain forensics, and open-source information available at the time of writing. While we strive for accuracy, readers should note that blockchain data can contain discrepancies and may evolve. Our findings reflect our understanding as of mid-2025 and may change as new information emerges. # ResupplyFi Exploit: From 1Wei to $ 10M

## Summary [On June 25th, Resupply Finance suffered a devastating exploit](https://x.com/ResupplyFi/status/1938092252431036491) that leveraged a simple one-wei collateral deposit to manipulate its exchange rate calculations, bypass loan-to-value (LTV) checks, and drain the full $9.8 million borrow limit in a single transaction. This incident once again highlights how classic DeFi vulnerabilities can turn a small oversight into a protocol-ending event within hours. [Resupply Finance](https://resupply.fi/) is a decentralized lending and borrowing protocol designed to provide users with access to on-chain liquidity through a system of collateralized vaults and[ **ERC-4626**](https://ethereum.org/en/developers/docs/standards/tokens/erc-4626/) yield-bearing strategies. It operates alongside multiple Curve-based pools and newer vault pairs under its ecosystem umbrella, with integrations into well-known liquidity layers like [Morpho](https://x.com/MorphoLabs?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) and [Curve ](https://www.curve.finance/dex/ethereum/pools/)Vaults, extending its reach within the broader DeFi landscape. [The first public alarm on the exploit was raised by BlockSec Phalcon](https://x.com/Phalcon_xyz/status/1938061381288530243), with early confirmations and damage assessments from [PeckShield](https://x.com/peckshield/status/1938061948647817647), [Slowmist](https://x.com/SlowMist_Team/status/1938073225503908072), and other prominent security firms. [Blockscope was among the first forensic teams to initiate deep on-chain tracing](https://x.com/BlockscopeCo/status/1938263643025449178), investigating suspicious flows, contract interactions, and fund laundering pathways within hours of the event.

### **Addresses & Transactions** * **Main Exploiter Address:** `0x6D9f6E900ac2CE6770Fd9f04f98B7B0fc355E2EA` * **Main Exploiter Contract:** `0x151aa63dbb7c605e7b0a173ab7375e1450e79238` * **Exploiter Contract (ETH Receiver):** `0xf90da523a7c19a0a3d8d4606242c46f1ee459dc7` * **Target Resupply Pair Contract:** `0x6e90c85a495d54c6d7e1f3400fef1f6e59f86bd6` * **Exploiter Wallet:** `0x31129a5c13306A48E827e851D44E19Ca07d4928A` * **Exploiter Wallet:** `0x886f786618623ffFB2be59830A47661Ae6492E16` * **Exploit Transaction :** `0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3` ## **Decoding the Exploit** The exploit was a sophisticated yet textbook **ERC4626 donation attack**, executed with surgical precision using two purpose-built contracts. The first **Exploiter Contract (ETH Receiver)** `0xf90da523a7c19a0a3d8d4606242c46f1ee459dc7`, acted purely as a simple ETH receiver, ensuring that any wrapped ETH (wETH) collected during the process could be unwrapped and sent out cleanly. The second, the **Main Exploit Contract** `0x151aa63dbb7c605e7b0a173ab7375e1450e7923`, embedded all the core logic needed to interact with the Morpho flash loan system, perform token swaps through **Curve**, and ultimately drain funds from **Resupply’s lending vault**.

Transaction logs confirms Flash loan from Morpho.

The exploiter’s sequence began with a deliberate but tiny **one-wei collateral deposit** into the freshly launched vault — just enough to bypass the vault’s non-zero collateral check. Next, the contract leveraged Morpho’s `FashLoan()` function to draw USDC in temporary liquidity. With this flash-borrowed capital, the exploiter immediately executed a swap on Curve’s StableSwap, converting the USDC into crvUSD, setting the stage for the core of the donation attack.

Trace Call shows Exploiter swapping USDC to crvUSD, and then staging the exploit on Resupply Pair, then swapping the reUSD back to crvUSD, then USDC and finally wETH.

Inside the same transaction, the exploiter exploited a flaw in Resupply’s share pricing logic. They minted a single share worth **1 wei** while simultaneously donating **2,000 crvUSD** to the vault controller. This combination inflated the vault’s apparent collateral value to an extreme, pushing the on-chain oracle’s price feed to report an artificially high collateral price. Ironically, due to Resupply’s flawed rounding formula, specifically, dividing `1e36` by the oracle’s new price, the system produced an exchange rate of zero. With the manipulated exchange rate effectively set to zero, Resupply’s **loan-to-value (LTV) check** always returned an LTV of **0**, no matter how much was borrowed. The system, therefore, treated the borrower as perfectly solvent. At the same time, the protocol’s calculation `totalDebtAvailable` failed to factor in the missing real collateral. As a result, the attacker could instantly access the protocol’s **entire borrow limit**, securing a loan of **10 million reUSD** backed by a deposit worth a single wei.

Transaction Decoder showing all the token transfers that happened during the exploit transcation. Tx. hash:`0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3`

After draining the vault, the attacker’s contract routed the stolen reUSD back through Curve, swapped it into more liquid tokens, repaid the original Morpho flash loan to close the loop cleanly, and converted the final profits back into ETH. In a final step, the **Exploiter** **Contract (ETH Receiver)** unwrapped the remaining wETH and distributed funds to the validator for priority inclusion and split the bulk of the stolen assets across two wallets. ### 🤖 **Blockscope AI Assist** Investigators and law enforcement agents work on multiple cases, and having access to the best tools is everyone’s right. With Blockscope’s advanced suite of forensics and monitoring tools, users can trace and analyze all on-chain activities in detail. But what if something is too technical or unclear? **Blockscope AI Assist** has their back. For example, in the **ResupplyFi Exploit**, the technical manipulation, multiple swaps, and flash loan logic can be challenging to follow. Using Blockscope AI Assist, users can easily break down trace calls and transactions, understand the flow, the entities involved, and see clear summaries — all in plain language. The best part? Users can **interact with our AI**, ask follow-up questions, and dig deeper for full clarity. No stuck points, no confusion — Blockscope AI Assist makes even the most complex exploits clear and actionable.

Trace Call Analysis of the Exploit Transcation using Blockscope AI Assist

## **On-Chain Activity** Using the **Tracer Tool,** we were able to visually clarify the exploit mechanics. Tracer 1 shows a clear graph depicting every ERC-20 transfer between various addresses controlled by the Exploiter.

Tracer 2 graphs the whole exploit, from Tornado Cash funding to post-exploit swaps. These visuals provide undeniable proof of each step and will be presented as annotated images in this report.

## **Breakdown and Timeline** ### **June 25, 2025 at 00:18 UTC:** **Resupply’s new wstUSR market** with $10 M debt limit goes live, just nearly 1.5 hours before the exploit. Tx. hash: `0x852eca15a9fd352817346915f7bc8817d46de349bd7a8fc6ee73c7b66ec9ab41` ### **June 25, 2025 at 1:50 UTC:** Exploiter funds the Main Wallet through Tornado Cash. Tx. hash: `0x1962eb353a37ca816a6d967279dfdb005a640fe3b22ccb9e00939fe5810d8fb5`

Exploiter received $2.40 K woth of ETH from Tornado Cash 1 ETH Pool

### **June 25, 2025 at 1:53 UTC** The **Main Exploiter Wallet** creates the **Exploiter Contract (ETH Receiver)** and begins the exploit. Everything happens in the same transaction. *Flash loan initiated → Curve swap → vault donation → exploit executed → funds split across multiple wallets.* Tx. hash: `0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3`

As of **July 2nd**, the two **Exploiter Wallets**, `0x31129a5c13306A48E827e851D44E19Ca07d4928A` and `0x886f786618623ffFB2be59830A47661Ae6492E16` are holding the stolen assets.

## **Ongoing Monitoring** Blockscope has deployed its public **Watchtower** to continue monitoring any suspicious flows related to the stolen funds and subsequent laundering paths. These dashboards will be updated in real-time to track fund movement across mixers, bridges, and centralized exchanges. Link: ## **Conclusion & ResupplyFi Response** The Resupply Finance exploit stands as a cautionary tale of how predictable vulnerabilities — like ERC4626 donation attacks and empty vault rounding bugs — can still slip through audits if deployment safeguards aren’t enforced. In the aftermath, ResupplyFi has paused affected markets, issued a detailed post-mortem, and started compensating affected users through an insurance pool with personal contributions from key contributors like **C2tP**. Community discussions continue around the **scope gap in audits**, the role of **Oracle price protections**, and governance best practices for safe vault deployment. Whether this exploit will push more protocols to adopt real-time solvency checks, more robust oracle integrations, or new anti-donation measures remains to be seen. ResupplyFi’s tragedy reminds everyone: in DeFi, a few hours is all it takes for unprotected math to cost millions. **Post Mortem & Recovery Plan by ResupplyFi:** **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Forensics Analyst @ Blockscope For more information, please reach out to us at ****

Disclaimer: Best Effort Report This article and its findings represent our best effort based on the information available at the time. However, please be aware of the following limitations: * The data used in this article may contain inaccuracies, omissions, or errors. * Information sources may be incomplete or subject to change. * New evidence may emerge that could alter the conclusions. * Analysis and interpretations are based on current understanding and may evolve. We have made every reasonable attempt to ensure accuracy, but we cannot guarantee that all information is entirely correct or complete. This report should be considered a snapshot of our current knowledge and understanding, subject to revision as new information becomes available. # Iranian Exchange Nobitex Suffers $90 Million Loss in Coordinated Crypto Hack

On June 18, 2025, [Nobitex](https://x.com/nobitexmarket), Iran's largest cryptocurrency exchange, suffered a major cyberattack, losing over $80-90 million USD worth of digital assets. The exploit affected multiple blockchain networks, including Tron, Bitcoin, Ethereum, Solana (SOL), and several other prominent networks. Responsibility for this incident was claimed by [Gonjeshke Darande](https://x.com/GonjeshkeDarand), an Israel-linked hacker group. Blockscope’s analysis revealed that the stolen assets were deposited into uniquely crafted vanity addresses, which appear to function as burner addresses, making all the stolen assets inaccessible to anyone. This cyberattack is particularly notable due to its timing, coinciding with rising geopolitical tensions in the Middle East. Unlike typical financial cyber incidents, the primary motivation behind this attack seems distinctly political, marking a significant shift in the nature and intent of blockchain-based cyber operations.

Gonjeshke Darande taking responsibiltiy of Notibex hack

## About Nobitex Nobitex has established itself as a central cryptocurrency platform within Iran, serving over 11 million users and holding substantial assets across diverse digital currencies. Despite its prominence, Nobitex has faced scrutiny for allegations involving sanction evasion and the facilitation of transactions potentially linked to sanctioned entities. Following the hack, Nobitex confirmed unauthorized access to its hot wallets but reassured users that its cold storage holdings remain secure, promising full compensation from its insurance fund.

## About Gonjeshke Darande The hacker group Gonjeshke Darande, aka Predatory Sparrow, a pro-Israel hacker group, has claimed responsibility for several high-profile cyber operations targeting Iranian institutions and infrastructure. Notably, just on June 17, [they reportedly disrupted Iranian Bank Sepah’s operations, destroying sensitive data](https://www.reuters.com/world/middle-east/suspected-israeli-hackers-claim-destroy-data-irans-bank-sepah-2025-06-17/). In the case of Nobitex, the group [threatened to publicly release internal exchange codes](https://x.com/GonjeshkeDarand/status/1935231018937536681), potentially placing remaining assets and infrastructure at risk.

Bank of Sepah's disruption's responsibiltiy being taken by Gonjeshke Darande

## Blockscope's Analysis and Insights In this attack, Blockscope observed the unusual use of vanity blockchain addresses, explicitly containing derogatory phrases aimed at the [**Islamic Revolutionary Guard Corps (IRGC)**](https://en.wikipedia.org/wiki/Islamic_Revolutionary_Guard_Corps), an entity designated as a terrorist organization by various jurisdictions, including the United States, Canada, the United Kingdom, and the European Union. There were a total of 8 vanity addresses involved in this whole incident, which have successfully burned around $90 M worth of assets. The addresses found so far are: * `TKFuckiRGCTerroristsNoBiTEXy2r7mNX` (Tron) * `1FuckiRGCTerroristsNoBiTEXXXaAovLX` (Bitcoin) * `0xffffffffffffffffffffffffffffffffffffdead` (Ethereum and Layer-2s) * `FuckiRGCTerroristsNoBiTEXXXXXXXXXXXXXXXXXXX` (Solana) * `rFuckiRGCTerroristsNoBiTEXypBrmUM` (Ripple) * `DFuckiRGCTerroristsNoBiTEXXXWLW65t` (Dogecoin) * `UQABFuckIRGCTerroristsNOBITEX1111111111111111_jT` (TON) * `one19fuckterr0rfuckterr0rfuckterr0rxn7kj7u` (Harmony) These addresses, most probably created through computational brute force, lack associated private keys, meaning the stolen funds sent to these addresses are essentially irretrievable, effectively "burning" the tokens. Blockscope's analysis indicates that this cyberattack started around 2:30 AM UTC, which started on Tron and then spanned over a dozen blockchain networks, notably: * Tron: \~$49.45 million * Ethereum: \~$24.28 million (Including Arbitrum, Polygon and Avalanche) * Bitcoin: \~$1.9 million * Significant additional losses occurred on Solana, XRP, DOGE, TON, Harmony, and Ethereum Classic networks. Using Blockscope's proprietary Tracer tools, we were able to meticulously track and analyze fund movements across these chains.

Blockscope’s Tracer tool visualizes multiple exploiter addresses draining funds from Nobitex.

The explicit use of vanity addresses underscores the non-financial motivation behind the attack, emphasizing a symbolic political statement rather than theft for profit, as all the addresses hold their funds. This reinforces the perception of the Nobitex hack as an act of geopolitical cyber aggression.

Tron exploiter address currently holds $49.45 million in USDT.

## Links to Sanctioned Entities Blockscope’s enriched on-chain data analysis also revealed historical interactions between Nobitex and several sanctioned entities, including organizations such as Hamas and Iranian nationals such as [Ahmad Khatibi Aghada and Amir Hossein Niakeen Ravari](https://ofac.treasury.gov/recent-actions/20220914). Both individuals are subject to secondary sanctions by the U.S. Office of Foreign Assets Control (OFAC) for their involvement in cyber-related activities and ransomware distribution.

Blockscope’s Tracer tool reveals Notibex exchange activity linked to sanctioned entities.

## Post-Incident Developments Nobitex has issued multiple announcements on X (formerly Twitter), providing timely updates to users in the wake of the incident. [The exchange confirmed that the vast majority of user assets remain secure](https://x.com/nobitexmarket/status/1935409871257579815), as they were held in cold storage, unaffected by the breach.

Nobitex Takes Responsibility and Reassures Users

In a further escalation, the hacker group [Gonjeshke Darande publicly released what they allege to be Nobitex’s source code](https://x.com/GonjeshkeDarand/status/1935593397156270534) and internal infrastructure documents. The materials were shared through their official X account in a thread consisting of eight posts.

### Something to give a thought While the stolen assets were transferred to unrecoverable vanity addresses—effectively burning the funds, over $50 million of the stolen value is in the form of USDT stablecoins. Although these tokens are now inaccessible, the fiat reserves backing them remain intact. This raises important questions about how Tether, the issuer of USDT, will respond in such a unique and politically sensitive scenario. ## How Blockscope Can Help Blockscope has been proactively monitoring the exploiter addresses associated with the Nobitex incident and continues to monitor for any new activity in the crypto ecosystem. Our data-enriched analytics platform offers advanced on-chain forensics, real-time monitoring, and robust compliance tooling. With millions of labeled entities and a powerful attribution engine, Blockscope enables businesses and exchanges to uphold stringent compliance standards while helping law enforcement and investigative teams trace illicit flows with speed and precision. This incident underscores the growing need for proactive threat intelligence and compliance in the crypto ecosystem—capabilities that are central to Blockscope’s mission. **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Forensics Analyst @ Blockscope For more information, please reach out to us at ****

## Summary On May 22, 2025, Cetus Protocol, the largest decentralized exchange (DEX) on the Sui Network, was exploited, resulting in approximately $223 million in losses due to a mathematical flaw. By using a single SCA (Single Collateral Asset) token and carefully selected tick ranges, the attacker drained liquidity pools. While $162 million was quickly frozen by Sui validators, over $60 million was bridged to Ethereum and subsequently converted into approximately 21,000 ETH. [Cetus Protocol](https://x.com/CetusProtocol?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) is a leading DEX on the Sui Network, known for providing high-performance, cost-effective token trading, leveraging advanced automated market-making (AMM) mechanics tailored for Sui’s scalable infrastructure. However, on Thursday morning, the protocol was nearly left empty of its entire TVL across all pools, as an exploiter drained the protocol and dumped SUI tokens for USDC. [The Sui ecosystem and Cetus team swiftly confirmed and publicly acknowledged the exploit](https://x.com/CetusProtocol/status/1925515668394582323). Sui validators implemented urgent mitigation measures, successfully [freezing around $162 million on Sui](https://x.com/SuiNetwork/status/1925572334054002774), while approximately $60 million was bridged to Ethereum in batches of roughly $1 million each, mostly in USDC.

Sui validators identified the exploiter’s address and actively ignored its transactions.

Following the attack, Cetus, along with [Inca Digital](https://x.com/inca_digital?lang=en), announced a $6 million bounty proposal to the exploiter, offering no legal action if the funds were returned. As of now, the exploiter has not responded, and Cetus is working closely with SUI and various law enforcement agencies to retrieve funds.

Transaction Decoder revealing the on-chain communication initiated by Cetus Protocol with the exploiter. Tx. hash: `0xae4c0e656fcd893c3213a6dc28513153fc02df2ae14b7241e9029503fe90ccd0`

### Relevant Addresses Cetus SUI Exploiter: `0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06` Cetus ETH Exploiter 1: `0x89012a55cd6b88e407c9d4ae9b3425f55924919b` Cetus ETH Exploiter 2: `0x0251536bfcf144b88e1afa8fe60184ffdb4caf16` ## Decoding the Exploit The Cetus Protocol exploit occurred due to a vulnerability within its CLMM (Concentrated Liquidity Market Maker) contract, stemming from an unchecked overflow in the open-source integer\_mate package (a math library commonly used in DeFi protocols to perform precision arithmetic operations). The attacker first executed a flash swap, temporarily suppressing pool prices. They then strategically opened a liquidity position spanning 200 ticks (price intervals within the liquidity range). By using just a single SCA (Single Collateral Asset) token, they manipulated the concentrated liquidity system to devastating effect. Specifically, the flawed `get_liquidity_from_a` function allowed the attacker to inject enormous liquidity using only a minimal amount of tokens. Although an overflow check existed, it only verified the numerator. When the tick range is narrow, the denominator approaches zero, effectively allowing near-infinite amplification (dividing by nearly zero). As a result, one SCA token was able to generate an astronomical 10,365,647,984,364,446,732,462,244,378,333,008 units of liquidity. The attacker took a flash loan of approximately 56,700 SUI, exploited the overflow to mint massive liquidity, withdrew the inflated liquidity, repaid the flash loan, and drained all illicitly generated profits — ultimately extracting $223 million. In the next section, we will decode the on-chain activity using Blockscope forensic tools. ## On-Chain Activity After draining the Cetus Protocol, the Cetus SUI Exploiter started to convert the stolen SUI into USDC to access deeper liquidity and enable cross-chain transfers. Approximately $60 million in USDC was bridged from Sui to Ethereum using Wormhole and Circle, where it was then systematically swapped into ETH through various DeFi protocols. Our Tracer tool has visualized this movement on a graph, mapping the systematic flow of bridged funds on Ethereum and their conversion into ETH.

Blockscope Tracer shows the movement of bridged funds on Ethereum

Backtracing revealed that Circle’s CCTP was likely used to transfer USDC to Ethereum. Contract `0x8656d3703ecbc5f36a9668a4859a7f1138bab0b3` possibly acted as a shim, emitting messages and providing gas to Cetus Exploiter 1. While its exact identity remains unknown, it is likely tied to a third-party DeFi relay. Tracer analysis shows that its creator and funder were funded by Coinbase's hot wallets.

Blockscope Tracer graphs Relayer/Shim contract and it's associates.

## Breakdown and Timeline ### **May 22, 2025 at 10:30 UTC** The exploit began with the CLMM contract being exploited, draining liquidity reserves. Approximately $223 million worth of tokens were compromised.

SuiVision shows Cetus protocol multiple AMMs were drained by Cetus SUI Exploiter.

### **May 22, 2025 at 10:47 UTC** Over $60 million was systematically bridged to Ethereum in multiple batches of a million each via Circle and Wormhole.

SuiVision shows bridging of funds to Ethereum.

### May 22, 2025 at 10:48 UTC Funds were received by Cetus ETH Exploiter 1, who converted the bridged USDC into approximately 21,000 ETH through various DeFi protocols like Cowswap and Paraswap.

Wallet Profiler shows token transfers of the Cetus ETH Exploiter 1.

### May 22, 2025 at 12:31 UTC ETH Exploiter 1 transferred a significant portion, approximately 20,000 ETH, to Cetus ETH Exploiter 2, which is currently holding the assets, valued at roughly $60–61 million. Tx. hash: `0xcf5500862c1bf696e5a7acc29559e2a549497846280b8d8a5349a74941bc921a`

Entity Interaction tool shows a single transfer of 20,000 ETH from Cetus ETH Exploiter 1 to Cetus ETH Exploiter 2.

### May 22, 2025 12:50 UTC Sui validators started voting on refusing to serve transactions signed by attacker’s addresses and effectively “froze” those addresses. Swiftly, the validators froze approximately $162 million to prevent further losses. Frozen Address 1: `0xcd8962dad278d8b50fa0f9eb0186bfa4cbdecc6d59377214c88d0286a0ac9562` Frozen Address 2: `0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06` ## Monitoring via Watchtower Blockscope has activated its watchtower and is doing real-time monitoring of the two Ethereum exploiter addresses to track any subsequent movements or transactions made by Exploiter. Link:

## Shim/Relayer Contract Tracing An intermediary shim/relayer contract `0x8656d3703ecbc5f36a9668a4859a7f1138bab0b3` funded the exploiter address with some gas and transmitted a message to mint USDC. Although benign in historical operations, including minor ETH gas funding and USDC minting, no direct malicious or definitive association with the exploiter or any specific DeFi protocol could be verified. This contract is likely a third-party bridging or routing service, potentially associated with Mayan Finance or another relay network, as nothing has been discovered that directly links it to Circle, but it appears to function as a message relayer for Circle CCTP and gas drop.

Cluster Analysis of the Ehereum addresses of Cetus Protocol Exploit

## Conclusion As of now, there have been no movements from the ETH exploiter addresses. Cetus Protocol is actively collaborating with law enforcement agencies and the Sui Network to pursue recovery efforts. The team initially offered a $6 million whitehat bounty to the exploiter for the safe return of funds, but after receiving no communication or response, [the bounty has been converted into a $5 million open reward for anyone](https://x.com/CetusProtocol/status/1925914205745459433) who can provide valuable information or assist in fund recovery. This comprehensive investigation provides critical insights into the mechanics of the May 22 Cetus Protocol exploit and the subsequent cross-chain fund movements. Continued monitoring, forensic tracking, and close collaboration with security partners are essential to trace, contain, and potentially recover the remaining stolen assets. The impact of this exploit has rippled beyond Cetus itself, affecting other decentralized exchanges (DEXs) on the Sui Network like [Bluefin](https://x.com/bluefinapp/status/1925621980532781117), [Turboas Finance](https://x.com/Turbos_finance/status/1925626231900291477), and[ FLowX Finance](https://x.com/FlowX_finance/status/1925685575568224431), some of which were forced to halt operations or initiate emergency audits. Furthermore, many ecosystem tokens saw their values plummet by over 75% following the attack, underscoring the widespread market disruption it caused.

FlowX Finance is temporarily halting services to ensure user fund safety.

Notably, [Cetus Protocol had undergone multiple rounds of audits](https://x.com/CetusProtocol/status/1915620102873243716), including one as recently as April by [Zellic](https://x.com/zellic_io), yet the vulnerability still slipped through — a stark reminder that even well-audited protocols are not immune to sophisticated attacks. Moving forward, the Cetus team remains committed to strengthening its security posture and working alongside the broader community to restore trust and resilience in the ecosystem. **Investigation by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Analyst @ Blockscope For more information, please reach out to us at ****

## Summary On April 15, 2025, [**KiloEx**](https://www.kiloex.io/)—a decentralized perpetual trading platform operating on BSC, opBNB, Base, and Manta Pacific—was exploited due to a critical smart contract vulnerability, resulting in a loss of approximately $8.4 million. Security firms, including [SlowMist, swiftly responded to assist the KiloEx team](https://x.com/SlowMist_Team/status/1911991384254402737) in investigating the incident and initiating contact with the attacker. ### What is KiloEx? [KiloEx](https://www.kiloex.io/) is a decentralized exchange designed for perpetual contract trading, optimized for high-speed and low-fee environments on L2 networks. Integrated with chains like opBNB and Base, it offers gas-efficient leverage trading for retail and institutional users alike. [KiloEx, with the help of SlowMist, initiated negotiations with the exploiter.](https://x.com/SlowMist_Team/status/1913184062656909646) On April 18, following a collaborative effort with security partners, the protocol successfully recovered 90% of the stolen funds by offering a white hat bounty to the exploiter, bringing partial resolution to a multi-chain exploit that could have had far worse consequences.

### Relevant addresses: Main Exploiter : `0x00faC92881556A90FdB19eAe9F23640B95B4bcBd` Keeper Contract: `0x796f1793599d7b6aca6a87516546ddf8e5f3aa9d` ## Decoding the Exploit The KiloEx exploit stemmed from a critical flaw in its meta-transaction handling, specifically within the `TrustedForwarder` contract. This contract inherited OpenZeppelin’s `MinimalForwarderUpgradeable`, which includes a default `execute()` function used to relay signed transactions. KiloEx failed to override or restrict this function, leaving it publicly accessible.

The `execute()` function in the `MinimalForwarderUpgradeable` contract, which contained the critical vulnerability exploited in the attack.

Using this path, the exploiter triggered a chain of calls, eventually manipulating the prices: #### **TrustedForwarder → PositionKeeper → Keeper → KiloPriceFeed**. The system was designed to allow only authorized `Keeper` contract to interact with sensitive functions like `delegateExecutePositions()`. However, the `PositionKeeper` contract only checked whether `msg.sender==TrustedForwader`, but not the identity of the original signer. This allowed the exploiter to pass a crafted signature and malicious calldata directly to the `execute()` function.

By exploiting this flaw, the attacker was able to call `setPrices()` in the `KiloPriceFeed` contract, first lowering the oracle price to open a long position, then raising it to close the position profitably—all within a single transaction.

Tx. Logs showing Exploiter got approval for unlimited spending access of Syenthetic USDC balance of KiloEx

This manipulation of internal pricing and trading logic allowed the attacker to extract unearned P\&L without real market movement. The exploit impacted multiple chains and highlighted the risks of insufficient access control in meta-transaction flows. Crucially, the system failed to validate not just the sender, but the authority of the signer.

TX. Decoder showing interaction between all the contracts involved in the exploit on Base. Tx. hash: `0x6b378c84aa57097fb5845f285476e33d6832b8090d36d02fe0e1aed909228edd`

## On-Chain Activity The exploit initiated on Ethereum, where the Main Exploiter `0x00faC92881556A90FdB19eAe9F23640B95B4bcBd` received initial funding from Tornado Cash: 1ETH Pool. Funds were then dispersed across Base, opBNB, Manta, Taiko, among others, using DeFi protocols for covering gas fees to initiate the exploit.

Tracer 1: Visualization of the KiloEx Main Exploiter distributing funds through cross-chain protocols to fund addresses across multiple networks.

The attacker then deployed a dedicated Exploiter contract `0xd649a0876453fc7626569b28e364262192874e18`on Base, conducting three malicious transactions and profiting over 3.32M USDC

Tracer 2: Visualization of synthetic asset (VUSD) transfers to the Keeper contract, subsequent burning of VUSD, and the Exploiter receiving equivalent USDC as profit and rewards, alongside interactions with Uniswap V3 for flash loans.

Subsequently, exploited funds were bridged back to Ethereum via DLNBridge, and various DeFi platforms were used to swap some of the USDC.

Tracer 3: Cross-chain movement of exploited funds from Base to Ethereum via bridging protocols.

## **Timeline and Breakdown** The attack was executed in a coordinated, phased manner, following a multi-chain approach across preparation, funding, deployment, and execution stages. For clarity, we will present a detailed breakdown of the activity on the Base network. ### April 13, 2025 at 23:31 UTC The attack originated on Ethereum, where the main exploiter `0x00fac92881556a90fdb19eae9f23640b95b4bcbd` received 0.9941 ETH from Tornado Cash: 1 ETH pool. This initial funding marked the beginning of the incident, with the exploiter subsequently bridging funds to opBNB, Base, BSC, Taiko, B2, and Manta to cover gas fees and initiate the exploit. (Visualized in Tracer Image 1.) Tx: hash: `0xa0fa4ab8ded0c07085d244e1981919b440f78b609e1cf8d7f8ee32d358dfdf46`

Token transfers feature shows exploiter receiving initial funding from Tornado Cash: 1 ETH Pool.

### April 14, 2025 at 12:04 UTC The exploiter address on Base `0x00fac92881556a90fdb19eae9f23640b95b4bcbd` was funded with 0.199 ETH via the Relay Link Bridge to cover gas fees and initiate the main exploit operations. Tx. hash: `0x14919f8f2211d0007e24fce9d77c5512f011df61d9655b6e16984be00667e66d`

Transaction Decoder shwoing the initial funding of the KiloEx Base Exploiter via the Relay Link Bridge.

### April 14, 2025 at 18:27 UTC The Base exploiter `0x00fac92881556a90fdb19eae9f23640b95b4bcbd` created and deployed a malicious contract `0xd649a0876453fc7626569b28e364262192874e18` to carry out the exploit. Tx. hash: 0x6f33006628760c91faede0fef756036ed0a72b826388ee4f573c33c81d048f4b

Flowchart showing creation of malicious contract by Base exploiter

### April 14, 2025 at 18:53 UTC The exploit commenced with the malicious contract being funded by the Base exploiter with ETH to cover operational gas fees. The exploiter then initiated flash loans from the Uniswap V3 pool, starting with 10,000 USDC.

Transaction Logs: Showing the transfer of 10,000 USDC to the Exploiter Contract via a flash loan from the Uniswap V3 pool.

Once the funds were secured, the exploiter initiated the attack by verifying the signature, invoking the `execute()` function on the `MinimalForwarder` contract, and sequentially interacting with the `PositionKeeper` and `Keeper contracts`.

Transaction Flowchart: Illustration of the exploit sequence, highlighting the price manipulation executed by the exploiter.

Ultimately, the price manipulation enabled the exploiter to generate illegitimate gains in the form of synthetic assets (VUSD).

The exploiter then repaid the flash loan and secured the profits in USDC. This method was repeated three times on the Base network alone, resulting in the extraction of approximately 3.3 million USDC. Tx. hash: 1. `0x6b378c84aa57097fb5845f285476e33d6832b8090d36d02fe0e1aed909228edd` ( *3.13M USDC* ) 2. `0xde7f5e78ea63cbdcd199f4b109db2a551b4462dec79e4dba37711f6c814b26e6` ( *186.60K USDC*) 3. `0xf0fcce0807a82041d050a60461e187f0e81a6f7fbda69bb600c04049d924e138` (*11.08K USDC*)

Execution of three transactions on KiloEx, resulting in the drainage of approximately 3.3 million USDC.

The attack was not limited to Base; it also impacted **opBNB, BSC, Taiko, B2, and Manta**, ultimately resulting in **total losses of approximately $8.445 million**.

BSC Exploiter`0x00fac92881556a90fdb19eae9f23640b95b4bcbd` drained 892K BSC-USD in a single transaction. Tx. hash: `0x1aaf5d1dc3cd07feb5530fbd6aa09d48b02cbd232f78a40c6ce8e12c55927d03`

## **Post-Exploit Response and Recovery** With the support of SlowMist, [KiloEx initiated negotiations with the exploiter](https://x.com/KiloEx_perp/status/1913168299292328115), offering a 10% bounty in exchange for the return of 90% of the stolen funds. Blockscope’s Tracer confirmed the return of assets to KiloEx’s Safe wallets across multiple chains on April 18, nearly 3.5 days post-exploit. The images below highlight the recovered assets: on Ethereum, returns were made in wBTC and DAI; on Base, returns were made in ETH and USDC to the designated recovery wallet `0xd38a22f5330f45162f13086d6ccbde0335c1ae9e`.

Additionally, using Blockscope’s Transaction Decoder, we were able to analyze and decode on-chain communications between KiloEx and the exploiter during the negotiation process.

On-chain communication between Exploiter and KiloEx

## **Conclusion & Security Reflection** Although funds recovery mitigated potential damage, this incident highlights ongoing security challenges in DeFi. Despite [undergoing five audits since 2023](https://docs.kiloex.io/kiloex/about-kiloex/audit), one of them recently in March 2025, KiloEx overlooked critical inherited contract permissions—a relatively simple yet costly oversight. This emphasizes that security cannot solely rely on periodic audits; continuous monitoring, dynamic threat modeling, and proactive security practices are essential. [Post-exploit audit by SlowMist](https://github.com/slowmist/Knowledge-Base/blob/master/open-report-V2/smart-contract/KiloEx%20Phase1%20-%20SlowMist%20Audit%20Report.pdf) and resumed operations reflect immediate response measures; however, achieving complete security is unrealistic without an ongoing commitment to proactive vigilance. To maintain transparency and accountability, [KiloEx also published a detailed post-incident report ](https://medium.com/@KiloEx/kiloex-security-incident-root-cause-analysis-post-mortem-3d899caac08c)addressing users' concerns.

***Security is not a checkbox—it’s a continuous process*****.** At [**Blockscope**](https://www.blockscope.co/), we advocate for real-time monitoring, dynamic threat modeling, and actionable intelligence as integral to every Web3 protocol’s lifecycle. **Investigation by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Blockchain Forensics Analyst @[ Blockscope](https://www.blockscope.co/) For more information, please reach out to us at ****

## Summary In 2024, the crypto space lost a staggering **$2.2 billion** across more than **303 separate exploits**. Alarmingly, incidents involving [**Private Key and Admin Privilege compromises** topped the charts, accounting for over **43% of all cases**](https://x.com/BlockscopeCo/status/1881782673531912686). Despite such clear security lessons, 2025 has already demonstrated that many protocols still struggle with fundamental key management practices. On **March 21st, 2025**, [Zoth](https://x.com/zothdotio?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)—a DeFi protocol bridging Traditional Finance (TradFi) and blockchain through tokenized Real-World Assets (RWAs)—experienced a severe exploit, losing approximately **$8.4 million**. The exploiter compromised Zoth’s admin keys, upgrading the **USD0PPSubVaultUpgradeable proxy contract** to a malicious implementation. This allowed the withdrawal of **8,851,750.3737 USD0++ tokens**, quickly converted first into **DAI**, then into **ETH**, and moved off-chain within minutes. Security firms [**SlowMist**](https://x.com/SlowMist_Team/status/1903020756830974217) and [**Cyvers**](https://x.com/CyversAlerts/status/1903021017460600885) promptly confirmed the exploit, highlighting critical vulnerabilities in admin key security.

Notably, this was Zoth’s second exploit in the same month. [On **March 1st**, a separate vulnerability in Zoth’s Loan-to-Value (LTV) validation logic resulted in a **$285,000 loss**,](https://blog.solidityscan.com/zoth-hack-analysis-80ba3ac5076b) where attackers manipulated liquidity pools to mint stablecoins without sufficient collateral.

**Zoth's March 1st Exploit; Attack Tx**.`0xc3f70057e261af554c6acf6a372389899f0c2d7d1ebd27311e39525dee88fb39`

### **What is Zoth?** [Zoth](https://x.com/zothdotio?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) is a DeFi protocol designed to bridge **TradFi** and **on-chain finance** through the tokenization of **Real-World Assets (RWAs)**. Central to Zoth’s platform is ZeUSD, a permissionless, omnichain (operates across multiple networks) stable token backed by high-quality assets like U.S. Treasury Bills and ETFs. Zoth aims to enhance liquidity, enabling users to engage seamlessly with decentralized exchanges, liquidity pools, and yield-generating DeFi products. ### Key Addresses Involved: * **Main Exploiter:** `0x3b33c5Cd948Be5863b72cB3D6e9C0b36E67d01E5` * **Victim Contract (Proxy):** `0x82f3a0392F58C50fa90542519832471BaE93e43e` * **Exploiter 2 (Holding Funds):** `0x7b0cd0D83565aDbB57585d0265b7D15d6D9f60cf` * **Malicious Implementation Contract:** `0xc89d7894341e13d5067d003af5346b257d861f56` * **Zoth deployer:** `0x3604582f56565d7060d73829ffb9ebd579218dca` Let’s now dive into the **root cause analysis** of the exploit to uncover how it happened and why it’s a wake-up call for the entire DeFi ecosystem. ## Decoding the Exploit The exploit on March 21st resulted from the compromise of **Zoth’s deployer wallet**, providing the attacker unrestricted administrative access. Leveraging these privileges, the attacker executed the **`upgradeToAndCall`** function on the **USD0PPSubVaultUpgradeable proxy contract**, installing a malicious implementation at address `0xc89d7894341e13d5067d003af5346b257d861f56`. This upgrade allowed the attacker to withdraw **8,851,750.3737 USD0++ tokens** (valued at **$8.4 million**), rapidly converting these funds first into **DAI**, then into **ETH**, before transferring them to an external address: `0x7b0cd0D83565aDbB57585d0265b7D15d6D9f60cf`.

**Blockscope's transaction flow chart shows the Deployer wallet upgrading the USD0PPSubVaultUpgradeable proxy contract; Tx. hash** `0xb2335f7bf58abbcaa006d0a2bed7db2c64a5dabed56fb1759260adc012c49abe`

The swift execution—from proxy contract manipulation to final fund transfer—reveals a carefully orchestrated exploitation of vulnerabilities stemming from insufficient admin key security measures. ## On-chain Activity The exploit becomes notably clear and intuitive once visualized through our **Tracer tool**. The flowchart below precisely illustrates the sequence of on-chain events, starting from the compromised **Zoth Vault (Victim)**. Initially, the attacker swiftly converts the stolen **USD0++ tokens** into **DAI**, transferring these funds directly to the **Main Attacker** address. Subsequently, the **DAI** is sent to an intermediary address labeled **Exploiter 2**, which utilizes the decentralized exchange **CowSwap** to convert the funds into **4,222.8881 ETH**. Some of these assets then flow to **Exploiter 3** `0x2128e6b2a8adabb00450fee4a65a660233735c4f` and **Exploiter 4** `0xcb03931637cbc8d486df81f4226955f80e1acd45`, which eventually routes funds to **Exploiter 5** `0x6ce41f95fc5514a3e8f74c5c500ef1b8a68e2316`, where a portion of the proceeds currently reside. This meticulously orchestrated series of transactions underscores the attacker’s swift, strategic approach and highlights the effectiveness of their methods for obscuring the trail of stolen funds.

## Exploit Breakdown ### Proxy upgrade Execution at 8:46 UTC, March 21 The exploiter first **compromised Zoth’s deployer wallet** `0x3604582f56565d7060d73829ffb9ebd579218dca`, which holds admin privileges for the protocol’s upgradeable contracts. Leveraging this key, at **8:46 UTC,** the exploiter executed the **`upgradeToAndCall`** function on the **USD0PPSubVaultUpgradeable** proxy `0x82f3a0392f58c50fa90542519832471bae93e43e`installing a **malicious implementation** at Exploiter Contract `0xc89d7894341e13d5067d003af5346b257d861f56`, thereby granting the attacker **full control** over the vault. **Transaction Hash:** `0xb2335f7bf58abbcaa006d0a2bed7db2c64a5dabed56fb1759260adc012c49abe`

Using the **Transaction Decoder**, we can see the **trace call** of the transaction where the **proxy was upgraded to the malicious contract**.

Transaction Logs showing the malicious contract being upgraded to the implementation contract, granting the attacker full control.

**Note:** The reason behind the deployer wallet compromise is still unknown, but typically, these exploits are associated with phishing or social engineering attacks rather than complex exploits. ### **Vault Drained at 8:47 UTC, March 21** Immediately after the upgrade, the malicious contract `0xc89d7894341e13d5067d003af5346b257d861f56` **withdraws 8,851,750.3737 USD0++ tokens**—worth approximately **$8.4 million** at the time. The withdrawal is completed in a matter of minutes, exploiting the proxy’s updated functions. **Transaction Hash:** `0x33bf669d125d11c432ac9b52b9d56161101c072fd8b0ac2aa390f5760fb50ca4`

Exploiter receiving millions of USD0++ Tokens form Victim Contract

### **Token Conversion at 9:01 UTC, March 21** The stolen **USD0++** is quickly **swapped for DAI** using CowSwap. The exploiter transfers the DAI to a second address (Labelled as **Exploiter 2** `0x7b0cd0D83565aDbB57585d0265b7D15d6D9f60cf`, ) which subsequently **swap it for ETH**, using **CowSwap**

CowSwap is levraged to swap stolen USD0++ inot DAI and ETH

### Final Transfer As of March 25th, the newly acquired **ETH** is consolidated into the attacker’s external wallet, labelled as **Exploiter 2** and **Exploiter 5**, completing the heist. At this stage, the attacker has **full custody** of the stolen funds in ETH, making recovery substantially more difficult.

## Analyzing Smart Contracts Identifying the root cause and unraveling exploit orchestrations in blockchain incidents can be highly challenging, particularly for users with limited technical expertise. **Blockscope's Contract Analysis and Contract Usage tools** significantly simplify this process by delivering clear, AI-powered explanations of smart contract functions. For instance, during the investigation of the Zoth exploit, **Blockscope's Contract Usage** tool was instrumental in rapidly identifying and understanding the functionalities of the malicious contract at address `0x82f3a0392f58c50fa90542519832471bae93e43e`. Users, even those without extensive blockchain knowledge, could quickly comprehend each function's role by simply clicking the "Explain" button, thereby streamlining the investigative process and enabling effective analysis.

Contract Usage tool displaying all functions of the malicious contract with AI-powered explanations.

## Monitoring To proactively track and respond to further developments, we've established a public watchtower monitoring all relevant addresses, particularly Exploiter 2 and Exploiter 5. Stakeholders can utilize this real-time visibility to enhance response measures and potentially mitigate further risks. Access the public watchtower:[ **Zoth Exploit Watchtower**](https://www.blockscope.co/community/watchtowers/67e3628787903a6fe128e992) ## Conclusion In summary, this incident underscores the critical need for rigorous security practices, continuous monitoring, and timely updates to smart contract permissions and controls. Enhanced vigilance and rapid response capabilities remain essential in minimizing damage and protecting decentralized ecosystems against similar sophisticated exploits. At [**Blockscope**](https://www.blockscope.co/), we develop tools and technologies to safeguard your assets and empower individuals and organizations to take accountability. We remain committed to continuously enhancing our analytical capabilities and tools, actively contributing to a safer blockchain ecosystem for all stakeholders. **Investigation by:** [**Tushar Tiwari**](https://in.linkedin.com/in/tushar-tiwari-1380271b7)**, Analyst @**[ **Blockscope**](https://www.blockscope.co/) For more information, please reach out to us at ****

## Summary On February 21, 2025, [Bybit](https://x.com/Bybit_Official), one of the leading cryptocurrency exchanges, suffered a massive security breach resulting in the loss of nearly $1.5 billion in Ethereum and various ERC20 tokens—including stETH, mETH, and cmETH—marking the largest digital heist in the crypto history. This unprecedented incident sent shockwaves throughout the digital asset landscape, raising concerns about the vulnerability of even the most established platforms. Early investigations revealed that the exploit was initiated through sophisticated social engineering tactics. Cybercriminals launched targeted phishing attacks against cold wallet signers, deceiving them into approving malicious transactions that replaced the secure multi-signature wallet contract with a compromised version. This critical lapse enabled the unauthorized transfer of 401,346.7688 ETH, 8,000 mETH, 90,375.5479 stETH, and 15,000 cmETH tokens during what appeared to be a routine transaction, with these assets collectively valued at approximately $1.5 billion.

Further analysis indicated potential state-sponsored involvement, with clear links to tactics commonly associated with DPRK-affiliated cybercriminals. Post attack investigations pointed to a targeted social engineering attack rather than a direct breach of Bybit’s systems. The exploit originated from a compromised developer machine at [Safe {Wallet}](https://x.com/safe), which was used to manipulate the wallet’s UI and deceive signers into approving unauthorized transactions. Evidence shows that the addresses used in the Bybit hack are also common with those from previous incidents targeting other major exchanges such as [Phemex](https://x.com/Phemex_official), [Poloniex](https://x.com/Poloniex), and [BingX](https://x.com/BingXOfficial). These recurring connections underscore a coordinated pattern of cyber exploitation and sophisticated laundering methods that point toward a broader, state-linked operation. In the aftermath of the breach, [CEO Ben Zhou](https://x.com/benbybit) went live to address the incident, outlining the immediate measures taken and reassuring the community of a robust recovery plan. The entire Bybit team demonstrated exceptional resilience and swift coordination in mitigating the damage, while the broader crypto industry united in support. Thanks to these collective efforts, [Bybit is now on track to achieve a 1:1 asset ratio,](https://x.com/benbybit/status/1893865556840775758) reflecting both the strength of its internal response and the solidarity of the global digital asset community. ### Key Addresses **Bybit Cold Wallet**: 0x1db92e2eebc8e0c075a02bea49a2935bcd2dfcf4 **Bybit Main Exploiter**: 0x47666fab8bd0ac7003bce3f5c3585383f09486e2 ## Decoding the Exploit Preliminary forensic analysis indicates that the breach exploited a critical vulnerability in the transaction signing workflow of Bybit’s Ethereum multisig cold wallet. [According to Bybit's official communications](https://x.com/Bybit_Official/status/1892965292931702929), the compromise occurred during what was expected to be a routine transfer from cold to warm storage. [The signing interface was "musked"](https://x.com/benbybit/status/1892963530422505586)—displaying seemingly legitimate transaction details while the underlying signing payload was surreptitiously altered. This manipulation enabled an unauthorized reconfiguration of the wallet’s smart contract logic, allowing the attacker to redirect funds to an external, unidentified address.

Flow chart showing the initiation of exploit

Despite these initial insights, the definitive technical root cause remains undetermined. Bybit’s security team, in collaboration with leading blockchain forensic experts, is investigating whether the vulnerability arose from compromised signing devices, a server-side breach, or a combination of both. Notably, all signers observed an interface with a URL that appeared to originate from [Safe {Wallet}](https://x.com/safe), suggesting that the attacker exploited a subtle decoupling between the displayed UI and the actual transaction data—a critical flaw that compromises the integrity of multisig protocols. In a separate update,[ Safe{Wallet} confirmed via social media that its codebase remains unmodified](https://x.com/safe/status/1893105625439093094), with no evidence of malicious dependencies or unauthorized infrastructure access, and that no additional Safe addresses have been affected. Similar exploit techniques have been observed in recent breaches at other major exchanges such as [Phemex](https://x.com/Phemex_official?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor),[ Poloniex](https://x.com/Poloniex), and [BingX](https://x.com/BingXOfficial), indicating a potential pattern linked to state-sponsored threat actors like the[ Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group), which are known for employing sophisticated front-end manipulation methods.

In response to the breach, CEO Ben Zhou and the Bybit team have maintained transparent communication and executed rapid containment measures. While confirming that the compromised cold wallet was the sole affected asset, [Bybit has continued normal withdrawal operations—processing over 350,000 withdrawal requests—to ensure customer fund security.](https://x.com/benbybit/status/1893102137711960486) Forensic analysis suggests that the stolen ETH is being laundered into Bitcoin via platforms such as [Chainflip](https://x.com/Chainflip), [eXch](https://exch.cx/), and [THORChain](https://x.com/THORChain?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor); [Chainflip has pledged to assist](https://x.com/Chainflip/status/1893222347252875386), whereas eXch and THORChain have only echoed Bybit’s request for support. This laundering technique mirrors known state-sponsored strategies, wherein illicit funds are converted to ETH, bridged to BTC through mixers and cross-chain solutions like Tornado Cash, eXch, and routed through Asian exchanges. Further forensic analysis by investigation firms and on-chain researchers identified the actual cause of the breach: a malicious JavaScript injection into a resource served from Safe {Wallet}'s AWS S3 bucket. This exploit manipulated the UI, deceiving signers into authorizing altered transactions. [Safe later acknowledged the issue](https://x.com/safe/status/1894768522720350673), confirming the compromise and releasing an update on X detailing their findings and implemented security measures. However, their report leaves several critical questions unanswered, particularly regarding how the attacker gained access to the S3 bucket and whether similar vulnerabilities persist.

[Bybit has launched a $150M bounty to aid fund recovery](https://x.com/Bybit_Official/status/1893322897243943330), with $2.17M USDT already paid to 11 contributors, including [Mantle](https://x.com/Mantle_Official), [Paraswap](https://x.com/paraswap), and [ZachXBT](https://x.com/zachxbt). As of March 4, nearly 500K ETH has been laundered to Bitcoin, where 77% of the stolen $1.4B remains traceable, 20% has gone dark, and 3% is frozen. The hacker converted 83% (\~$1B) to BTC via THORChain (72% traceable), while 16% (\~$180M) disappeared through eXch and 8% (\~$100M) moved through OKX Web3 Proxy, with $65M still untraceable. ## Onchain Activity Using **Blockscope's Tracer tool**, our analysis has uncovered a complex network of intermediary wallets designed to obscure the movement of the stolen funds. Initially, the exploiter partitioned the compromised assets by splitting the stolen ETH into multiple distinct wallets while consolidating all stolen ERC20 tokens—namely stETH, cmETH, and mETH—into just two primary addresses.

Bybit Cold Wallet getting drained by Exploiter

Subsequent on-chain tracking reveals that approximately 401,000 ETH was distributed among 40 intermediary wallets.

Cluster of Intermediary Wallets holding 10k ETH each

The attacker then leveraged multiple DeFi protocols, including Paraswap, Uniswap, DODO, and Lido, to swap all the ERC20 tokens into ETH.

Stolen ERC20 tokens getting converted to ETH

Currently, the exploiters are executing multi-layered laundering which not only complicates asset tracing but also highlights the sophisticated techniques employed to disguise the fund flow and impede recovery efforts. Cross-chain bridges like Chainflip and protocols like eXch and Thorchain are being used to convert the stolen ETH to BTC.

Web of Intermediatry wallets to launder funds

Chainflip and eXch are being leveraged to launder Ethereum funds by bridging them into Bitcoin.

## Breakdown and Timeline ### February 21, 2025, 14:16 UTC The exploit began with the attacker’s primary wallet, 0x0fa09c3a328792253f8dee7116848723b72a6d2e, which initiated a transaction by calling Bybit's cold wallet at 0x1db92e2eebc8e0c075a02bea49a2935bcd2dfcf4 and transferring 401,346.7688 ETH. This transaction confirms that the attacker had already breached the cold wallet’s security, gaining unauthorized access and executing a direct fund transfer. Tx. hash:0xb61413c495fdad6114a7aa863a00b2e3c28945979a10885b12b30316ea9f072c

ETh getting drained from the cold wallet to the exploiter wallet

### February 21, 2025; 14:41 - 15:12 UTC In a few minutes, the exploiter drains 10000, 50000, and 30375.5479 stETH in three separate transactions, transferring them to its intermediary wallet 0xa4b2fd68593b6f34e51cb9edb66e71c1b4ab449e. Meanwhile, at 15:10 UTC, the exploiter also transferred 8000 mETH to the same wallet.

### February 21, 2025; 15:23 UTC The exploit escalated when the attacker drained 15,000 cmETH—valued at approximately $43 million—and transferred it to the intermediary wallet 0x1542368a03ad1f03d96d51b414f4738961cf4443.

### February 21, 2025; 14: 56 - 15:54 UTC Following the breach, the attacker distributed the stolen ETH across approximately 40 distinct wallets, with roughly 10,000 ETH allocated to each.

Exploiter transferring ETH from main wallet to side wallets

### February 21, 2025; 14:29 UTC The attacker then converted all stolen stETH, mETH, and cmETH into ETH using various DeFi protocols—including Uniswap, Paraswap, DODO, and Lido—ultimately acquiring approximately 98,048.7948 ETH. This amount was subsequently distributed among multiple wallets, each receiving roughly 10,000 ETH.

Exploiter burning cmETH to eventually convert it into ETH

stETH and mETH getting converted into ETH

### Obfuscation and Laundering At present, our on-chain analysis and watchtower indicate that the exploiters are actively laundering funds through [eXch](https://exch.cx/) and [THORChain](https://x.com/THORChain?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor), following a laundering pattern consistent with tactics historically associated with North Korean threat actors. Intermediary wallets holding approximately 10,000 ETH are systematically distributing funds to multiple addresses, while wallets with balances under 100 ETH are funneled through eXch and converted into Bitcoin, effectively obfuscating the illicit asset trail.

As of February 26, all the stolen ETH is being laundered using [THORChain](https://x.com/THORChain?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor), which has successfully [processed over $260 million in illicit ETH transactions](https://www.coinspeaker.com/thorchain-dex-volume-soars-amid-bybit-hack-rune-jumps-22/).

Exploiters are laundering funds through various intermediary wallets

Thorchain has till now laundered more than $260M worth of assets

In this critical period of industry consolidation, [THORChain](https://x.com/THORChain?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) stands as a key enabler of illicit activity, profiting significantly as its fee volume surges due to the heavy laundering operations linked to North Korean exploiters. With the platform facilitating the movement of stolen assets, continuous monitoring and enhanced oversight remain imperative to mitigate further exploitation.

Thorchain fees volume are sky rocketing as it generate more than $2 M in last few days.

Between the day of hack and now, [THORChain saw an unprecedented $5.5+ billion in trading volume,](https://x.com/arkham/status/1896968970206634487) generating millions in fees, with nearly all activity tied to Bybit’s laundered funds. Since the exploit, North Korean attackers have successfully bridged and laundered most of the stolen assets, nearly 500,000 ETH to Bitcoin using THORChain and eXch. Now entering the second phase of laundering, they are obfuscating BTC origins through mixers like [Wasabi](https://wasabiwallet.io/) and [TornadoCash](https://x.com/tornadocash?lang=en)—a tactic they have historically relied on to erase financial trails. Initial tranches of stolen BTC have already begun flowing into these services, marking a critical moment in the laundering process. ## Monitoring Since the day of the exploit, the Blockscope team has been actively monitoring the evolving situation on Bybit. By deploying our watchtower on key wallet addresses, we have identified several hundred addresses directly linked to the exploiter. To date, nearly half of these wallets have begun moving their funds, while the remaining half continues to hold approximately 10,000 ETH. Our ongoing surveillance remains crucial in tracking and mitigating further illicit activity. Link to the Bybit Watchtower:

### Tracing the North Korean Exploit Network Our monitoring efforts have uncovered compelling evidence linking the current breach to broader state-sponsored activities. Notably, on-chain sleuth [ZackXBT](https://x.com/zachxbt?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) highlighted similar exploit patterns and common addresses involved in major exchange exploits like [Phemex](https://x.com/Phemex_official), [BingX](https://x.com/BingXOfficial), and [Poloniex](https://x.com/Poloniex). Using our advanced Blockscope tools, we verified these claims and confirmed the presence of common intermediary wallets across these platforms. This convergence of wallet activity suggests a coordinated network of exploits that aligns with tactics historically attributed to North Korean threat actors, further underscoring the sophisticated nature of these operations. **Common addresses found between the exploits:** **BingX & Bybit-** 0xd555789b146256253cd4540da28dcff6e44f6e50 **Phemex & Bybit-** 0x33d057af74779925c4b2e720a820387cb89f8f65 **Poloniex & Bybit-** 0x15ec300a4895a86322f1a27dd9ba0b9f8297e65d

Tracing Bybit, Phemex, and BingX exploits revealed common addresses, indicating that the same actors are behind these exploi

TA common address was identified linking Bybit and Poloniex, suggesting the same actors are involved.

## Conclusion The Bybit breach stands as the largest crypto heist to date, with clear evidence linking the exploit to North Korean state-sponsored operations. The sophisticated attack exploited vulnerabilities in Bybit’s multi-sig cold wallet signing process, triggering an intricate laundering scheme that dispersed stolen funds across numerous intermediary wallets. The [FBI has further reinforced these findings in a public announcement](https://x.com/Cointelegraph/status/1894912646845210833), officially attributing the exploit to North Korean actors.

[While Bybit has since stabilized its operations](https://x.com/Bybit_Official/status/1893928666117382325), this incident serves as a stark reminder of the inherent vulnerabilities in the digital asset ecosystem and the evolving threats that challenge even the most robust security measures. Stay updated on [**Lazarusbounty.com**](http://Lazarusbounty.com)—Bybit’s dedicated bounty site—where new findings on hacker addresses, cross-chain asset tracking, and ranked wallet balances are posted. [Blockscope](https://x.com/BlockscopeCo) has been at the forefront of this investigation from the very first alarm. By deploying the tracer tool and establishing a dedicated watchtower on key wallet addresses, our team has identified hundreds of addresses directly linked to the exploiter. The transparency of blockchain technology—where every transaction is publicly recorded—enables cybersecurity professionals and authorities to trace illicit activities in real-time. The swift response from Bybit and robust collaboration across the crypto community underscores our collective commitment to fortifying defenses against sophisticated cyber threats. **Investigation by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Analyst @ Blockscope For more information, please reach out to us at ****

## Summary On January 24, 2025, Singapore-based centralized exchange [**Phemex**](https://phemex.com/register?group=\&referralCode=BLB8M8\&gad_source=1\&gclid=CjwKCAiAh6y9BhBREiwApBLHC2WHyREHoCLTuNXQBxhsC0dwiho4J76V06ox1NcJ4JgwaXpZXoklTxoCTJQQAvD_BwE) suffered the largest crypto heist of the year, losing between **$69M and $85M** across **16 blockchains,** as per various sources. The attacker exploited vulnerabilities in Phemex’s hot wallets, siphoning assets like **ETH, BTC, SOL, USDC and USDT**. This breach underscores the dangers of multi-chain operations—where a single security lapse can trigger catastrophic losses across multiple networks. Phemex, a major player in both spot and derivatives trading, is known for its deep liquidity and seamless cross-chain transactions via bridges like [**Synapse**](https://phemex.com/academy/what-is-synapse-protocol-syn-crypto). These bridges function as automated market makers (AMMs), facilitating asset swaps across different blockchains using stable swap algorithms. However, their reliance on centralized liquidity pools creates an attractive attack surface for sophisticated adversaries. The exploit was first detected by blockchain security firms like [**PeckShield**](https://x.com/peckshield/status/1882402547744534675?t=V6YRuhotHzO2t9WsSryncQ\&s=19) and [**Cyvers**](https://x.com/CyversAlerts/status/1882407857447997803), which flagged unusual transaction patterns originating from Phemex’s hot wallets. Security logs later revealed that attackers had infiltrated these internet-connected wallets on multiple chains, including **Ethereum, BNB Chain, Optimism, Polygon, Base, and Arbitrum**.

Notably, the attackers prioritized **freeze-prone assets**, swiftly converting stablecoins into ETH to evade blacklisting.[ MetaMask security researcher **Taylor Monahan** said to The Block](https://www.theblock.co/post/336754/north-korea-hack-group-possibly-behind-70-million-phemex-exploit-experts-say)," In this case, we see a massive amount of distinct assets drained simultaneously across a multitude of chains. The tokens are then immediately swapped for the native asset, starting with the freezable stablecoins and then working down the list by value." In response,[ Phemex suspended withdrawals and reassured users that cold wallets remained untouched.](https://x.com/Phemex_official/status/1882417902038749317) CEO [**Federico Variola** attempted to restore trust by publishing proof of reserves](https://x.com/Federico0x/status/1882411493280649237). However, the damage was already done—Ethereum alone saw $20.41M drained, followed by $17.01M on Solana.

## How did the Exploit happen? The root cause likely stems from **a compromised private key or a breach in access controls—both common patterns in CEX-related exploits**. However, what made Phemex’s case uniquely devastating was its **multi-chain footprint**, which allowed the exploit to escalate rapidly. Given the synchronized nature of the attack across 16 networks, it’s plausible that a single point of failure, such as a compromised signing mechanism or an internal key management leak, provided attackers with unrestricted access. The attack began on **January 23, 2025, at 11:48 UTC on Solana**, and within minutes, Ethereum wallets were also drained. Over the following hours, assets were systematically siphoned from hot wallets across BNB Chain, Optimism, Polygon, Base, XRP, TRON, and Arbitrum. The attackers methodically withdrew high-value, easily blacklisted assets like USDT and USDC first, before moving on to less liquid tokens. Unlike automated flash loan exploits, this attack was manually orchestrated, with funds being funneled through fresh wallets before being consolidated for laundering. Given the precision and operational scale, this heist exhibits hallmarks of state-sponsored threat actors, with [speculation pointing toward **North Korean hacker groups**](https://www.theblock.co/post/336754/north-korea-hack-group-possibly-behind-70-million-phemex-exploit-experts-say). Historically, similar CEX breaches have been shrouded in secrecy, making it difficult to determine the full extent of the compromise. ## Blockscope’s Investigation Utilizing **Blockscope’s Tracer tool**, we meticulously tracked the flow of assets across six different EVM chains, including Ethereum, compromised by the exploit. Through our address group functionality, we created custom address groups, simplifying the complex on-chain movements for clearer analysis. This not only underscores Blockscope's capabilities in unraveling intricate exploits but also highlights our role in empowering security operations with actionable insights.

Below is a breakdown of the major networks breached, along with the compromised hot wallets, attacker addresses, and the amounts lost during this exploit.

Assets	Hot Wallet	Attacker Address	Amount Lost
ETHEREUM	0x50be13b54f3eebbe415d20250598d81280e56772	0x5B34414e95a8b8D0B16a39BAf5b97CEc1d517E22	$20 M
SOLANA	EWSHJzKpzjpwz9GuNKkXWMHXAiwtB7obSGhdFKu5QZku	3q38w9HpZcVGrKp43WSJa6KQpEfSDSoAyaebuARwbU8B	$17 M
BITCOIN	bc1q32sxnq5hecdurfzgzp5x0zh8du86v9x84wdqdx	bc1q7v5se5aq37g3lw8ccgre2laktpt6qrjvxqcz4p	$5.06 M
XRP	rQKKvBvEfXbTThkqrtqaY3sAKuW6iqcMzX	rGSu6JJ9dLZ3mpfGhtFczNjZjgoHEJcHgf	$13.48 M
ARBITRUM	0x50be13b54f3eebbe415d20250598d81280e56772	0x069987773b3DeE7AC4afFb9f06A4a90f9984AB10	$988.22 K
OPTIMISM	0x50be13b54f3eebbe415d20250598d81280e56772	0xE9AA4a999ca1D9093054CF4f5dc221a06D433650	$497.46 K
AVALANCHE	0x50be13b54f3eebbe415d20250598d81280e56772	0x17BCC630B1409637D42dFb278f8E2ea9fc862631	$1.08 M
TRON	THAABzWrhp84Nr7gxss7qhtzA5mp3d1qUo	TBz3DH6GUpg4cEGrcKzs8gSTvLQCGaYk5F	$1.7 M
BSC	0x50be13b54f3eebbe415d20250598d81280e56772	0x6C42F03d730b7643939fA1D00416cB2985eD9cF3	$3.33 M
BASE	0x50be13b54f3eebbe415d20250598d81280e56772	0x392d99Ec0348172C046cd64b85C21Df0927ab946	$2.42M
POLYGON	0x50be13b54f3eebbe415d20250598d81280e56772	0xf493033B14cE39CBC6a283921eA50919C5D43Dfe	$685.42 K
ZKSYNC ERA	0x50be13b54f3eebbe415d20250598d81280e56772	0xEba89b66C132E7fAd2a238BF416Fb9d45dcAd1FF	$256 K
SUI	0x51fc8f63faf7b22d401623f9c3ae5183e564d701741770f12ad1851c6c45a0c8	0x4eff816c3fe9bd163d223546ef60020f0162ab4206339a0f14bdb60b639f0794	$2.97 M

Source: Blockscope's Wallet Profiler,[ Rekt](https://rekt.news/phemex-rekt/), [PeckSheild](https://x.com/peckshield/status/1882781762411176037), and [Chaincather](https://www.chaincatcher.com/en/article/2164582) In the following sections, we will delve into the **mechanics of the hack on Ethereum** and some major **Layer 2 networks**, offering a comprehensive look at this multi-million breach. # Ethereum Ethereum suffered the biggest loss in the Phemex exploit, with approximately $20 million drained across multiple transactions over 1.5 hours. The attacker systematically emptied Phemex’s hot wallets on Ethereum, siphoning native ETH, wBTC, and stablecoins such as USDC, USDT, DAI, USDP, GUSD, and BUSD. In addition to these high-value assets, a wide range of ERC-20 tokens and meme coins, including PEPE, AAVE, and GALA, were also stolen—along with countless others. **Hot Wallet:** 0x50be13b54f3eebbe415d20250598d81280e56772 **Exploiter:** 0x5b34414e95a8b8d0b16a39baf5b97cec1d517e22 **Time of Breach:** 11:49 UTC **Amount lost**: $20 M approx. ## On-chain Activity The exploit on Ethereum was highly complex, involving dozens of tokens. However, Blockscope's tools streamlined the investigation, making it manageable. Our Tracer tool efficiently visualized the movement of assets, consolidating major tokens into a single, comprehensive analysis. The tracer below illustrates the interaction between Phemex’s hot wallet and the attacker’s address, with USDC—the largest stolen asset on Ethereum (\~$1.77M)—used as the primary example.

Tracer showing Exploiter draining 1.76 M USDC from Phemex Hot Wallet

Once the exploiter drained funds from Phemex’s hot wallet, the "funnel and tunnel" phase began. To highlight the complexity of the exploit, we created a focused tracer using only five tokens—ETH, AAVE, USDT, USDC, and PEPE—depicting just the first and second stages of tunneling into side wallets and exchanges, which we have grouped as "Side Wallets" and "DeFi Platforms".

Ethereum Tracer for Phemex Exploit showing movement of top 5 assets

The tracer above reveals that the exploiter funneled stolen assets through various DeFi platforms like [**Uniswap**](https://app.uniswap.org/)**,** [**SushiSwap**](https://www.sushi.com/ethereum/swap)**,** [**DODO**](https://dodoex.io/en)**,** and [**1inch**](https://1inch.io/), swapping and redistributing funds across multiple addresses. To map out the exploiter's broader network of side wallets and linked addresses, we leveraged Blockscope’s **Cohort Analyzer tool**—filtering out DeFi protocol contracts to isolate only the exploiter’s activity.

## Breakdown and Timeline ### January 23, 2024 - 11:49 UTC The Phemex Exploiter (0x5b34..) initiated the exploit on Ethereum, first draining funds from Phemex’s Hot Wallet (0x50be..). The first asset drained was USDC (\~$1,767,958 USDC). Tx. hash: 0xcf345cddde4286f7e2d37e9783f5e8c33f47a125a23370423596f92f3b884b62

USDC being stolen from Phemex Hot Wallet

### January 23, 2024 - Between 11:50 - 13:31 UTC The exploiter (0x5b34..) continued draining assets from Phemex’s hot wallet (0x50be..) and our investigation revealed that over 150+ tokens, including stablecoins, protocol tokens, and meme coins, were siphoned. Tx. hash for Major asset drains: USDT: 0xe7ce7b050242d99f673a76792596d1f47f76eec73d229e4b35bf2d3be9ec9722 AAVE: 0xf63b542f23fd150659e66c34700dc584c7bb12afcef1e7cf2109abf077dafdd7 SHIBA INU: 0xcb5d4a99cb121396d11b407529f18f6659c0656921f32bd35be9ee9022d719d7 ETH: 0x87755934af576784b6c31f583c270981e867f018d5760ff1a64f652be1303cc1

First transactions of Exploit on Ethereum shown using Transcation Decoder

**One highlight here will be all high-value, freezable assets like USDC, USDT, and other stablecoins were drained first between 11:49 - 11:55 UTC, while meme coins and protocol-native tokens were targeted later, highlighting a deliberate and structured attack strategy focused on maximizing liquidity and minimizing intervention risks.**

Last Transactions of Exploit on Ethereum

### January 23rd, 2025 Between 12:00 - 15:00 UTC As the exploiter drained assets, they simultaneously transferred funds from the main wallet to four key side wallets, as shown in the tracer below. Within minutes, these assets were further tunneled into additional side wallets, creating multiple layers of obfuscation. Side wallets: 1. 0x140dea3b704d724ddff41597b35a10ce0189661f 2. 0x069987773b3dee7ac4affb9f06a4a90f9984ab10 3. 0x6c42f03d730b7643939fa1d00416cb2985ed9cf3 4. 0x17bcc630b1409637d42dfb278f8e2ea9fc862631

Tracer showing top 5 stolen assets being send to side wallet by the exploiter

### January 23rd, 2025 Around 14:00 UTC With the valuable assets fully drained, the exploiter shifted focus to tunneling and swapping tokens through DeFi services like Uniswap, SushiSwap, DODO, and 1inch.

**The tracer below provides a clear example of this strategy—one of the exploiter's side wallets, 0x0699..., sends AAVE and PEPE, receiving ETH in return.** This pattern was repeated across multiple side wallets, allowing the exploiter to convert a variety of stolen assets into ETH and other liquid tokens, ensuring easier laundering and reducing exposure to asset freezes. At present, the exploiter still holds funds across several side wallets and is actively working to launder them.

Tracer showing Swapping of AAVE and PEPE by the Exploiter

This highly orchestrated exploit enabled the exploiter to drain approximately $20M from Phemex’s Ethereum hot wallet alone. However, this was only part of a broader operation. A parallel attack took place on Solana at 11:49 UTC—one minute earlier than Ethereum—resulting in the theft of $17M from one of the largest Layer 1 networks today. ## **Beyond Ethereum: The Multichain Expansion** While Ethereum suffered significant losses, the exploit was not confined to a single chain. The exploiter leveraged a multichain strategy, expanding their operations across Layer-2 networks to further obscure and diversify stolen funds. In the next section, we’ll investigate how this coordinated heist unfolded across multiple Layer-2 ecosystems, examining potential synergies between Mainnet and Layer-2 addresses and uncovering the deeper cross-chain laundering tactics employed. # Layer-2s While Ethereum was the primary target in the Phemex exploit, with over 60% of stolen assets coming from Ethereum, XRP, Bitcoin, and Solana, the attackers also capitalized on major Layer 2 (L2) networks. Given their growing adoption in DeFi, L2s such as **Optimism, Arbitrum, Base, Avalanche, and BSC** became key battlegrounds in the attack. These L2 solutions are designed to scale Ethereum, offering lower fees and faster transactions. However, their integration with Ethereum’s ecosystem also makes them susceptible to cross-chain exploits. In the Phemex hack, **losses across EVM-compatible L2s alone exceeded $9 million**, highlighting that attackers are increasingly targeting these networks. ## On-Chain Activity Across L2s By analyzing Phemex’s compromised hot wallets across multiple networks, we visualized the full scope of the exploit using our blockchain forensics tools. Below, we break down some of the major affected L2s: ### 1. [Base](https://www.base.org/) (Layer 2 -[ Coinbase)](https://www.coinbase.com/en-ca) * **Hot Wallet:** 0x50be13b54f3eebbe415d20250598d81280e56772 * **Exploiter:** 0x392d99ec0348172c046cd64b85c21df0927ab946 * **Time of Breach:** 11:52 UTC * **Loss:** \~$2M (ETH, USDC, Aerodrome, Degen, Luna by Virtuals, Brett, AgentLayer) #### Attack Breakdown The Phemex Base Exploiter drained ETH and USDC, prioritizing USDC as a freezable asset, before converting stolen tokens into ETH using the [**Odos Protocol**](https://www.odos.xyz/) for optimal liquidity.

Base Tracer shows ETH and USDC being drained, swapped, and eventually bridged.

Base Exploiter is draining ETH, USDC, and various ERC-20 tokens from the Phemex hot wallet.

Odos Protocol being used to swap various tokens for ETH

The final step involved bridging assets to Ethereum Mainnet via [**Stargate Protocol**](https://stargate.finance/), effectively obscuring the origin of the stolen funds. **Our Transaction Decoder enabled us to identify the destination chain ID, revealing where the bridged funds were sent.**

Stargate Protocl being used to bridge fudns cross-chain

### 2. [BNB Chain ](https://www.bnbchain.org/en)(Layer 2 - [Binance](https://www.binance.com/en)) * **Hot Wallet:** 0x50be13b54f3eebbe415d20250598d81280e56772 * **Exploiter:** 0x6c42f03d730b7643939fa1d00416cb2985ed9cf3 * **Time of Breach:** 11:52 UTC * **Loss:** \~$3M (BNB, BUSD, BTCB, PancakeSwap Token) #### Attack Breakdown The Phemex BNB Exploiter drained multiple tokens, swapping all ERC-20 assets into BNB using [**ParaSwap**](https://www.paraswap.xyz/) for liquidity.

Phemex Exploiter draining Phemex Hot Wallet

ParaSwap is being used to swap various asstes into BNB

The stolen BNB was consolidated into the wallet 0xd760cc6f2d41e43309912d54a0955dbc8a77890f, marking the final stage of the exploit on BNB chain.

$3.33 M BNB being transferred to 0xd760c...

### 3. Other Layer 2s Beyond Base and BSC, the attackers targeted additional Ethereum Layer 2 networks, each exploited for significant sums. These included **Optimism, Arbitrum, and Avalanche**, where attackers followed a **similar pattern of asset drainage, liquidity swaps, and cross-chain movement.**

Avalanche Hot Wallet getting drained out for $1.08 M

Exploiter stealing various tokens on ARB including ETH, USDC, USDT, ARB, GMX and XAI

And just like that, over $9 million disappeared across all Layer 2 networks within a few hours. # Conclusion The Phemex exploit was not just another hack—it was a highly coordinated, cross-chain operation that exposed critical vulnerabilities across Ethereum, Layer 2s, and Solana. The attackers moved with precision and speed, draining assets and leveraging DEX aggregators, cross-chain bridges, and DeFi protocols to obscure their tracks, making fund recovery an uphill battle. This incident raises **urgent questions** about security in the multichain era. **Are smart contract audits and protocol security checks enough?** With exploiters **targeting CEX hot wallets and rapidly dispersing funds across multiple chains**, **are centralized exchanges truly prepared for multichain threats?** As DeFi and CEXs become increasingly interconnected, security strategies must go beyond isolated audits. Real-time monitoring, on-chain surveillance, and proactive exploit detection will be critical in preventing the next major heist. ## [**Blockscope**](https://www.blockscope.co/)**: Advancing Blockchain Security** At [**Blockscope**](https://www.blockscope.co/), we provide cutting-edge blockchain forensics and real-time monitoring tools, enabling businesses to protect their assets and assisting law enforcement agencies in tracking illicit activities and apprehending bad actors. Our advanced analytics enhance security across DeFi and CEX ecosystems, making the blockchain space safer for all stakeholders. The Phemex exploit serves as a wake-up call—as blockchain technology evolves, so must our security measures. **The question is no longer if another attack will happen, but when—and whether the industry is ready to stop it.** The investigation utilized a suite of advanced forensic tools from Blockscope to meticulously trace and analyze the attack. Key findings include: * **Transaction Decoder**: Deconstructed transactions to analyze the exploiter’s multichain movements, sequence of events, and asset bridging using protocols like Stargate. * **Wallet Profiler**: Identified attacker wallets, stolen assets, and suspicious transactions across multiple networks. * **Tracer Tool**: Tracked stolen tokens, including ERC-20, stablecoins, and native assets, as they moved across wallets and DeFi protocols. * **Cohort Analyzer**: Mapped clusters of associated wallets, uncovering the exploiter’s network and operational footprint on Ethereum. **Investigation by:** [**Tushar Tiwari**](https://in.linkedin.com/in/tushar-tiwari-1380271b7)**, Analyst @ Blockscope** For more information, please reach out to us at ****

## Summary [On January 8th, 2025, Moby announced to its users that, despite their claims of secure smart contracts and robust key management, an exploiter identified a vulnerability and exploited it, resulting in significant theft. ](https://x.com/Moby_trade/status/1877096336140677458) [Moby](https://moby.trade/), a decentralized options trading platform on Arbitrum, offers real-time pricing, low spreads, and deep liquidity. The platform utilizes liquidity pools, such as sOLP (stablecoins) and mOLP (crypto + stablecoins), to facilitate efficient on-chain derivatives trading. The exploit was possible after Moby's **Admin-privileged private key** was compromised, allowing the attacker to upgrade key smart contracts. This breach led to the theft of **3.77 wBTC, 207.76 wETH, and 1,500,351.5 USDC,** assets equivalent to **$2,557,683.79**. In times of crisis, unexpected help can arrive, and that’s exactly what happened with the intervention of the [**Seal911 team**](https://x.com/_seal_org?lang=en). They managed to recover 1.4M USDC from the stolen funds, however, the remaining funds were converted and dispersed across various bridges, resulting in a **total loss of approximately $1,109,914.17.** ## How Did It Happen? The root cause of the attack was the compromise of Moby's admin-privileged private key, supposedly secured under *"Secured Key Management."* With access to this key, the attacker gained privileges, allowing them to upgrade core smart contracts, creating a security breach. Once the attacker identified this vulnerability, they conducted a [test attack on the Arbitrum Sepolia](https://sepolia.arbiscan.io/tx/0xbf97d408ed11e0161d6667457c3a17b6947bc1b7a339e3201bc1d01c36f0ac78) network. An hour later, they executed the exploit on the mainnet, initiating the drainage of funds. The stolen funds were then bridged from Arbitrum to Ethereum, and the attacker began dispersing and laundering the assets across numerous wallets. In response, Moby publicly acknowledged the attack and contacted security teams, including [Seal911](https://x.com/_seal_org?lang=en) and [SlowMist](https://www.slowmist.com/). They also reached out to protocols like [Circle](https://www.circle.com/) and [Rhino.fi](https://rhino.fi/), used by the attacker, to block and freeze assets, preventing further obfuscation. [Seal911 successfully thwarted ](https://x.com/tonykebot/status/1877240687256580248)another attempt by the attacker to exploit a smart contract, recovering approximately 1,470,191.71 USDC in the process. Unfortunately, the [wBTC and wETH stolen during the attack were irretrievable](https://x.com/tonykebot/status/1877240698031800749), as they had already been drained. The attacker converted the remaining assets into **312.02 ETH** and used the [**Stargate protocol**](https://x.com/stargatefinance?lang=en) to bridge them onto the Ethereum mainnet. To further obscure the trail, the attacker employed several tunneling addresses and utilized bridges like [**DLN** ](https://x.com/dln_trade?lang=en)to launder the funds. Some of the wallets associated with the attacker still hold portions of the stolen ETH. Let’s visualize and break down the entire exploit using Blockscope’s advanced analytics and forensic tools. ## On-chain Activity The Moby exploit is a multichain operation that began on the Arbitrum Sepolia Testnet, moved to the Arbitrum Mainnet, and then bridged to the Ethereum Mainnet to obscure the trail. Currently, the laundered funds are still being bridged across chains. **Moby Attacker:** 0x2a566D111d0a5Be888FEC5F3834434Af3245Bb1b **Moby Attacker 2:** 0x6A92D4840309f447922114a349984a1d09a51470 **Total Assets Lost:** 3.77 wBTC, 207.76 wETH and 30,179.97 USDC Using **Tracer**, we visualized the entire exploit, tracking how funds moved from the S\_Vault and M\_Vault contracts to the attacker, and noted the conversion of stolen assets using Uniswap.

Attacker's token movement before bridging to Ethereum

Once converted to ETH, the funds were bridged to the Ethereum Mainnet using Stargate. The recipient address on Ethereum Mainnet was the attacker's second address, which was also used for cross-chain bridging: 0x6a92d4840309f447922114a349984a1d09a51470***.***

Tracer shows transfer of stolen wETH from Arbitrum to Ethereum using Stargate

After receiving 312.02 ETH, this address tunneled the funds and distributed them across numerous other addresses in an attempt to obfuscate and launder the assets. Several of these tunneling addresses used the DLN protocol to bridge assets cross-chain to networks like Polygon Mainnet, while most still hold the stolen assets. Our tracer for the Ethereum Mainnet illustrates the flow and current state of the assets involved in this exploit.

The tracer below shows how the attacker leveraged bridges to launder and obfuscate funds. In the below transaction, the Attacker's side wallets 0xe5240366f033ae373ff68ccffe552ea1d460b1d0 can be seen bridging around 3 ETH from the Ethereum mainnet to Polygon mainnet using DLN bridge and receiving 21,339 POL at address 0x36d137d85a8a0c8d30cec57aeda82b4eff1ebade. Tx. Hash: 0x35031f2fca5558df30bbcca228c06027357a4481f8a413d782c568c9e0a475e9

0xe52...b1d0 bridging ETH to Polygon Mainnet using DLN Protocol

## Exploit Breakdown & Timeline ### **January 8, 2025 - 11:56 UTC** The attacker, using Moby Attacker wallet 0x2a566D111d0a5Be888FEC5F3834434Af3245Bb1b, prepared the exploit on the Arbitrum Sepolia Testnet after obtaining the admin-privileged private key. Tx. hash: 0xbf97d408ed11e0161d6667457c3a17b6947bc1b7a339e3201bc1d01c36f0ac78 ### January 8, 2025 - **12:57 UTC** The attacker initiated the attack. Utilizing the stolen private key, the attacker executed a contract upgrade, and changed the proxy admin at **1:49 UTC**, eventually gaining ownership and admin rights on the primary address. Tx. hash: 0x9da34da770f1e9c5d5e176578b32710d8e288587d8401582f34a9631edf9be4b

### January 8, 2025 - Between **15:24 to 15:28 UTC** After securing admin rights, the attacker altered the ownership of the S\_Vault Contract 0xd4d23332e6256b751e2da0b9c0b3a70cfe9180c0 and executed three Emergency Withdrawals, transferring 0.07 wBTC, 0.79 wETH, and 30,179.79 USDC to the primary address. Tx. hashes: USDC: 0xfb260f58332034fe203a41b031c41b8461f469e46d5632b33b328f22aed1fb42 wBTC: 0xa64829baf5b83fb6fbebcac334f2c73f6d8ec31a4c8b210538e32105c8ca8566 wETH: 0x15890f9b4db381875d2e1e606f5c0b39540295f2af7ab34abe4dd4722dde18d2

Transfer of assets from S_Vault contract

### **January 8, 2025 - 16:37 UTC** The attacker performed a similar admin change on the M\_Vault Contract 0x9e34f79e39addb64f4874203066ffddd6ab63a41, making two transfers of 3.70 wBTC and 206.97 wETH to the primary address between **16:47 and 16:48 UTC.** Tx. hashes: wETH: 0xa16b4751f802b01ad9f71a9a44f534afc943c5b1952551d6a06e75207eee917a wBTC: 0x5729abb3d2898e80b24b08f3f079c5b5022db72fb97972e56ea68230b1efbacc

Transfer of assets from M_Vault contract

### January 8, 2025 - **16:48 UTC** Seal911 identified the vulnerability and fixed the smart contract by upgrading it, preventing the loss of 1,470,191.71 USDC from the exploited M\_Vault Contract. Tx. hash: 0xa247fb0c2a641ad09f3c798c754662ee46ec56ebebc85c17afa397fdeaafe64a

Seal911 recovered the vulnerable 1.47M USDC

### **January 8, 2025 - 16:50 UTC** The attacker transferred 3.70 wBTC and 206.97 wETH to the Bridging Address Moby Attacker 2 0x6A92D4840309f447922114a349984a1d09a51470 and 30,179.97 USDC into the Uniswap V3 pool. Tx. hashes: wETH: 0xa16b4751f802b01ad9f71a9a44f534afc943c5b1952551d6a06e75207eee917a wBTC: 0x5729abb3d2898e80b24b08f3f079c5b5022db72fb97972e56ea68230b1efbacc

Transfer of stolen wETH and wBTC to Moby Attacker 2

### January 8, 2025 - Between **16:59 to 17:01 UTC** The attacker converted 206.97 wETH and 3.70 wBTC into 312.02 ETH using swaps, primarily through Uniswap. Tx. hashes: wETH: 0xa605d246b5a4f01de5bfe7864055ab331aab3ffa11ffcf9e84a669f22201c612 wBTC: 0x670b17897045b5e1745e43ffc59dee103135f3ead600684d6bb67fa57763a61b

### **January 8, 2025 - Between 17:11 to 17:25 UTC** The attacker bridged all the funds to the Moby Attacker 2 0x6A92D4840309f447922114a349984a1d09a51470 from Arbitrum to Ethereum Mainnet using the Stargate protocol.

Using Stargate protocol, Moby Attacker 2 bridged 312.02 ETH from Arbitrum to Ethereum mainnet

### January 8, 2025 - **17:26 UTC** The attacker began dispersing ETH across numerous wallets to obfuscate the trail. Some ETH was bridged using the **DLN protocol** while most remained in side wallets.

Attacker did some cross-chain bridging to launder & obfuscate assets

### January 8, 2025 - **20:53 UTC** [Moby Trade tweeted about the exploit](https://x.com/Moby_trade/status/1877096336140677458), responding hours after the incident. On **January 10th at 13:27 UTC**, Moby published its [Post-Mortem Report and Growth Plan](https://x.com/Moby_trade/status/1877708786783392232), post exploit.

## Wallets and Addresses Found In this investigation, we identified a substantial list of addresses linked to the attacker, which were used to tunnel, bridge, and obfuscate the stolen assets. Using the **Cohort Analysis Tool**, we demonstrated a clear and direct relationship between the attacker and the addresses listed in the table below.

Cohort Analysis on Ethereum mainnet, shows relationship between attacker's wallets

### List of Associated Addresses

Note	Address
Moby Attacker (Primary Address on ARB)	0x2a566d111d0a5be888fec5f3834434af3245bb1b
Moby Attacker 2 (Bridging Address on ARB and ETH)	0x6a92d4840309f447922114a349984a1d09a51470
Side Wallet (ETH)	0x5267c4e531b00597ef0cce0dc591c30fad7e4137
Side Wallet(ETH)	0x3d5908d723db3e75962b464935ec72b25f279488
Side Wallet(ETH)	0x0261254a0ea9c4065727b77b2680fe0726010e49
Side Wallet(ETH)	0x1bb090b419b1437247eca7fc4c2a847f7222cd1a
Side Wallet(ETH)	0x5ecbe4f3d08594e42a3ebe3752fa6d6fa0bc8d38
Side Wallet(ETH)	0x07b00bab187a1acc4dfb18190b5652a6d86795f9
Side Wallet(ETH)	0x396b19959cabecb07787190044c11aaf48c44a05
Side Wallet (ETH)	0x83629c00266bd68c60634caff34646162233700b
Side Wallet (ETH)	0xa6523e3bdf6a798ef3cd8a5e1d55e6d82416dc02
Side Wallet (ETH)	0x8b0e842de81b4cde581a139e5b6a67027c679349
Side Wallet (ETH; Bridged funds)	0x8a564053192b5566edae8b0305d7d40040913eab
Side Wallet (ETH; Bridged funds)	0xe5240366f033ae373ff68ccffe552ea1d460b1d0
Side Wallet (ETH; Bridged funds)	0x06d86f0c7b563571460f2369abc051ced744ca31
Side Wallet (ETH; Bridged funds)	0xba021c7817e7b1ea2ad103fb535f75f07f9b2571
Side Wallet (ETH; Bridged funds)	0x2b9d98682e179c52eb031a8b42cd3ac56e0c7e8e
Side Wallet (ETH)	0xbcf24b2f2f1a7f8c3709f40bfd12be1469608108
Side Wallet (ETH)	0x818051846e1cb33c9775ecc68f9ec24fa8872d50
Side Wallet (ETH)	0xad6049d1fe59ce49b71386c45bb6348a9d2e45be
Side Wallet (ETH)	0xfbf735e81a1c430729dca17fc927df46c269fe6f
Side Wallet (ETH)	0x81ebcb5cb748df13ad117aad9d828d8ebc7056a2
Side Wallet (ETH)	0x246159d610ab6165f9445a6a22f2fa63782b710e
Side Wallet (ETH)	0x06894cf8308b5235733ee42ce57e4524d1642f6b
Side Wallet (ETH)	0x65aeeb98e3b59a18b8dfa3f2c8ee376828da7782
Side Wallet (ETH)	0xa90da10c49ba8f751d6d5b7fb4788b499277cdab
Side Wallet (ETH)	0x61b7e18ba8ba0413a9ae61cbb263507afb53b7cc

## On-Going Monitoring Moby Trade is actively collaborating with various security firms, law enforcement agencies, and exchanges to freeze stolen assets and prevent successful obfuscation and laundering attempts. Additionally, [we have deployed our **Watchtower** system to continuously monitor all side wallets still holding ETH on the Ethereum Mainnet. ](https://www.blockscope.co/community/watchtowers/6792e161e8c4d608b73070f3)

## Conclusion This exploit serves as a critical reminder that companies handling public funds must be held accountable and take proactive security measures. Moby Trade’s response—downplaying the incident by stating that their smart contracts "worked properly" and attributing the breach to stolen private keys—highlights the need for better responsibility in securing sensitive information. On a positive note, this case underscores the importance of blockchain security. The **Seal911 team** successfully recovered approximately **$1.4M USDC**, and [Tony Ke’s tweet captures their achievement](https://x.com/tonykebot/status/1877240684266295373). As noted, the attacker exploited the system by upgrading the smart contract using the **UUPS (Universal Upgradeable Proxy Standard)** but failed to secure it, leaving a vulnerability that Seal911 was able to leverage.

At [**Blockscope**](https://www.blockscope.co/), we develop tools and technologies to safeguard your assets and empower individuals and organizations to take accountability. As attackers evolve and become increasingly sophisticated, so must our security measures. The Moby Trade exploit is a powerful example of how security firms can make a significant impact in the fight against cybercrime. The investigation utilized a suite of advanced tools from Blockscope and forensic techniques to meticulously trace and analyze the events of the hack. Here's a summary: * **Transaction Decoder**: Deconstructed transactions to understand the attacker's actions and sequence of events, and how the contract was upgraded into UUPS. * **Wallet Profiler**: Identified attacker wallets, analyzed suspicious transactions on Arbitrum and Ethereum and revealed obfuscation using Stargate and DLN protocols. * **Tracer Tool**: Tracked stolen tokens like wETH, wBTC, and USDC across wallets and DeFi protocols, including cross-chain movement from Arbitrum to Ethereum. * **Entity Interaction Tool**: Mapped interactions between Stargate protocol and Moby Attacker 2 to bridge funds. * **Cohort Analyzer**: Identified clusters of associated wallets, clarifying the attacker’s network on Ethereum. * **Watchtower**: Monitored and tracked all wallets and side addresses involved in the exploit in real time. **Investigation by:** [**Tushar Tiwari**](https://research.blockscope.co/moby-trade-and-the-breached-private-key/www.linkedin.com/in/tushartiwari21)**, Analyst @** [**Blockscope**](https://www.blockscope.co/) For more information, please reach out to us at ****

Disclaimer: Best Effort Investigation This investigation and its findings represent our best effort based on the information available at the time. However, please be aware of the following limitations: * The data used in this investigation may contain inaccuracies, omissions, or errors. * Information sources may be incomplete or subject to change. * New evidence may emerge that could alter the conclusions. * Analysis and interpretations are based on current understanding and may evolve. We have made every reasonable attempt to ensure accuracy, but cannot guarantee that all information is entirely correct or complete. This report should be considered a snapshot of our current knowledge and understanding, subject to revision as new information becomes available. # The Penpie Heist On September 3rd, 2024,[ **Penpie**](https://www.pendle.magpiexyz.io/stake), a yield farming protocol built on the [**Pendle Finance**](https://www.pendle.finance/) ecosystem, suffered a major exploit that led to the loss of approximately **$27 million** in crypto assets. The attacker exploited vulnerabilities in Penpie by introducing a fake market on Pendle Finance, using malicious contracts disguised as SY (Standardized Yield) Tokens, which were linked to Pendle Liquidity Provider Tokens (LPT). This manipulation enabled the attacker to artificially inflate rewards, which were subsequently redeemed for various assets, including **staked ETH (stETH)**, **agETH**, **rswETH**, **sUSDE**, and **gUSDC**. ## **Penpie’s Role in Pendle Finance** Penpie plays a pivotal role within the **Pendle Finance ecosystem** by offering yield optimization and boosting services using **veTokenomics (Voting Escrow Tokenomics)**. Through Penpie, users can lock **PENDLE tokens**, gain governance rights, and maximize both their rewards and governance participation. These functionalities are critical in enhancing the overall utility and growth of Pendle Finance. ## **Attack Overview and Initial Response** Following the exploit, both **Penpie** and **Pendle Finance** promptly halted their operations to limit further damage. Despite these measures, the exploit significantly impacted the tokens associated with both protocols. **Penpie’s native token (PNP)** saw a dramatic **40% drop** in value, while **PENDLE** itself experienced a **9% decline**. This rapid devaluation highlights the far-reaching consequences of security vulnerabilities in decentralized finance (DeFi) ecosystems. **SY** - Standardized Yield Tokens are the contracts to wrap any yield bearing tokens. **PT**- Principal Tokens represents the principal amount in the future date **YT**- Yield Tokens represents future yield **LPT**- Liquidity provide Tokens are a certificate of providing liquidity in the protocol **PRT**- Pool Reward Toekns are a certificate you get after depositing LPT into Penpie Pool ### **Addresses and Transactions** * **Main Attacker Address**: 0x7a2f4d625fb21f5e51562ce8dc2e722e12a61d1b * **Malicious SY Contracts:** 1. 0x4af4c234b8cb6e060797e87afb724cfb1d320bb7 2. 0x4476b6ca46b28182944ed750e74e2bb1752f87ae 3. 0xcde2cd6aeaaf0238f4ce33295be13704e4a97de2 4. 0x4BC9815b859c8172CEe1ab2CD372fD0Eb00eb487 **• Key Exploit Transactions**: 1. 0x42b2ec27c732100dd9037c76da415e10329ea41598de453bb0c0c9ea7ce0d8e5 (Ethereum) 2. 0x7e7f9548f301d3dd863eac94e6190cb742ab6aa9d7730549ff743bf84cbd21d1 (Ethereum) 3. 0x56e09abb35ff12271fdb38ff8a23e4d4a7396844426a94c4d3af2e8b7a0a2813 (Ethereum) 4. 0x67c5400da117b906f8c0fc5f5149e4ea10ed6358cd9ea2ec0ed8f559d757b7df (Arbitrum) ## Decoding the Exploit The root cause of the exploit was **Penpie’s flawed assumption** that all markets created on Pendle were legitimate. The attacker was able to create three malicious **SY contract** and mint counterfeit tokens, including **PT-stETH 26DEC2024 (Principal Tokens)** and **YT-stETH 26DEC2024 (Yield Tokens)**. By staking these counterfeit tokens, the attacker acquired **Liquidity Provider Tokens (LPT)**, which were then deposited into **Penpie’s pool** to receive **Pool Reward Tokens (PRT)**. The attacker leveraged the **batchHarvestMarketRewards()** function in the **Pendle Staking Contract**. By utilizing **flash loans** from **Balancer** ( A DeFi protocol), particularly involving **sUSDE**, **wstETH**, **agETH** and **rswETH**, they injected significant liquidity into the fake market. This liquidity inflow triggered the **redeemRewards()** function of the malicious SY contract, which temporarily inflated the attacker’s staking balance. As a result, they were able to claim disproportionately large rewards. A key vulnerability that was exploited in this attack was the **absence of a reentrancy guard**. The attacker was able to repeatedly call the reward function within the same transaction, as they were the sole depositor in the fake market. This allowed them to continuously harvest rewards, leading to the unauthorized accumulation of assets. Once the rewards were claimed, the attacker burned the PRT tokens, withdrew all liquidity, and redeemed the rewards. The flash loans were subsequently repaid, and the attacker walked away four times with nearly **$27 Million**. An important thing to mention that this exploit not only happened on Ethereum, but on Arbitrum as well. This attack underscores the critical need for **market validation**, **reentrancy protections**, and **improved reward distribution mechanisms** in DeFi protocols. ## Hack Breakdown and Timeline #### 1. **Creation of Malicious Contracts and Tokens** at 1:41 PM on 3rd Sept, 2024 At 1:41 PM on September 3rd, the attacker created the malicious SY contract. They used it to mint **fake PT and YT tokens** linked to non-existent assets. (*Tx-0xfda0dde38fa4c5b0e13c506782527a039d3a87f93f9208c104ee569a642172cd2*).

Attack contract as SY contract with PT and YT tokens

#### **2. Creation of Fake Pendle Market at 1:44 PM on 3rd September** By **1:44 PM**, the attacker used the malicious tokens to create a fake market in Penpie’s system. This fake market enabled them to manipulate the liquidity pools. (*Tx-0xfda0dde38fa4c5b0e13c506782527a039d3a87f93f9208c1 04ee569a642172d2*)

#### **3. First Attack Execution at 2:23 PM on 3rd September** The attacker used **Attacker 2** address (*0xc0eb7e6e2b94aa43bdd0c60e645fe915d5c6eb84*), And used **flash loans** from **Balancer** to inflate liquidity with assets like **wstETH, sUSDE, agETH**, and **rswETH**.

Once having enough liquidity, the attacker manipulated batchHarvestMarketRewards() function which allowed the Attacker to call redeemRewards() function, allowing to harvest rewards multiple times, despite providing no real liquidity.

After removing all the liquidity and withdrawing all the rewards, along with returning the flash loans, the exploiter transferred all the funds from the Attack contract to Attacker 1 at 2:27 Pm (*Tx-0x5f348e5d7802bdfcb5e3b7515d8d0a50c6a1067cf2fe6633334abce4bc2ee8f0*).

#### **4. Creation of another Malicious SY Contract at 2:31 PM on 3rd September** The attacker continued to exploit Penpie using a similar strategy by creating new malicious SY contract.

On important thing to mention, all the fake tokens were introduced using **PendleYeildContractFactory** contract and all the Fake markets creation were done by **PendleMarketFactoryV3** contract. The main reason behind creation of fake YT and PT tokens is to get the valuable LP and PRT tokens, as a proof of providing liquidity and inflate the rewards.

#### **5. The Second Attack at 2:37 PM on 3rd September** Now, the Attacker after getting the PRT and YT tokens, began again by knocking the doors of Balancer Vault and borrowing large amounnts of agETH and rswETH tokens through flash loans.

Then again they exploited the batchHarvestMarketRewards() function of the pool and triggering redeemRewards function of the new Fake Market (0x5b6c...), setting the rewards to the new two market tokens, depositing them into the Penpie Pool and triggering multiclaim() function fo the Master Penpie contract being the only depositer.

This allowed him to withdraw the LPT tokens. Finally, the Attacker burnt the PRT tokens, withdrew all the rewards and liquidity, paid by the flash loans, eventually profitting.

#### **6. Creation of Another Malicious SY contract at 2:38 PM on 3rd September** The Attacker executed the same startegy third time in the similar fashion, gaining some more agETH and rswETH.

## Tracing the Funds Using **Blockscope’s Tracer** tool, we identified the paths taken by the attacker to obscure the stolen funds. The image below shows the transfer of funds to the Attacker from various Malicious contracts.

The majority of assets were funneled through **Tornado Cash**, making further tracking difficult. The visualization tool clearly highlights the **Rubic Offset Router** being used to swap rewards and various intermediary addresses that facilitated fund tunneling.

## Associated Addresses Let's have a look on all the major addresses invloved in this Penpie Exploit. Although we found a lot of addresses and wallets but we would like to mention only the relevant ones, which makes sense. Using our Cohort Analysis, we have tried to visualize all the major wallets and contracts involved int his exploit.

### List of all the Associated Addresses | Identity | Detail | Address | | ------------------------------ | ------------------------------------------------------------ | ------------------------------------------ | | Main Attacker | The main attacker wallet of the the exploit | 0x7a2f4d625fb21f5e51562ce8dc2e722e12a61d1b | | Attacker 2 | Wallet used to transfer funds with first SY contract exploit | 0xc0eb7e6e2b94aa43bdd0c60e645fe915d5c6eb84 | | Attacker 3 | Used for tunneling and off boarding funds | 0x28e3fd9edca8fccb912fe3ab36c78f96cfc74769 | | Attacker 4 | Used for tunneling and off boarding funds | 0x69751b7e52dbbd64281ec9049dfa623c7ecdeb52 | | Attacker 5 | Used for tunneling and off boarding funds | 0x2f2dde668e5426463e05d795f5297db334f61c39 | | Attacker 6 | Used for tunneling and off boarding funds | 0x2dc15e0ff02f39d4d23a96d6ef2595df3d1e18a0 | | Attacker 7 | Used for tunneling and off boarding funds | 0x415a7916c0f52a95f16034d74fb89528c0fc1b11 | | Attacker 8 | Used for tunneling and off boarding funds | 0x8c37ad70ce51e54d2d75da40668e9530d337f26b | | Attacker 9 | Used for tunneling and off boarding funds | 0x688413d6cae1c0e0882e274a98e0b901fdf7233c | | Attacker 10 | Used for tunneling and off boarding funds | 0xf61aa5fdb43ecbb90ff12086045c9432eee3d03e | | Attacker 11 | Used for tunneling and off boarding funds | 0x10f8c81386a2563f687011f4ebc8f2091cb501e8 | | Attacker 12 | Used for tunneling and off boarding funds | 0x37767e2d9131c84441567da5474158b0918b65a4 | | Malicious SY Contract | Contract used in first attack | 0x4af4c234b8cb6e060797e87afb724cfb1d320bb7 | | Malicious SY Contract 2 | Contract used in second attack | 0x4476b6ca46b28182944ed750e74e2bb1752f87ae | | Malicious SY Contract 3 | Contract used in third attack | 0xcde2cd6aeaaf0238f4ce33295be13704e4a97de2 | | Malicious Contract on Arbitrum | Contract used in the attack on Arbitrum | 0x4BC9815b859c8172CEe1ab2CD372fD0Eb00eb487 | ## Notable Obervations **Cross-Chain Exploit**:\ The attack was executed not only on Ethereum but also on **Arbitrum**, where the attacker leveraged flash loans in **gUSDC** and exploited the protocol similarly using another malicious contract (0x4bc9815b859c8172cee1ab2cd372fd0eb00eb487).

**Audited Protocols**:\ Despite being audited by [**WatchPug**](https://www.watchpug.org/) and [**Zokyo**](https://zokyo.io/), Penpie and Pendle Finance failed to detect the critical vulnerabilities that enabled this reentrancy attack. This highlights the necessity for ongoing audits and real-time monitoring. **Messages to Attacker**:\ Numerous messages were sent to the attacker post-exploit, including offers of assistance from bounty hunters and others who were attempting to capitalize on the situation.

## Monitoring We’ve activated **Blockscope’s Watchtower** to continuously monitor transactions involving more than 12 addresses linked to the [**$27 Million Penpie Hack**](https://www.blockscope.co/community/watchtowers/670e6e844de553085e827486). Our public watchtower provides real-time surveillance, ensuring no suspicious movement goes unnoticed as we work to track and analyze the attacker's activities. ## Conclusion The **$27 million Penpie exploit** serves as a reminder of the vulnerabilities that persist in the DeFi ecosystem, despite audits and security checks. Strengthening market validation processes and implementing better safeguards like **reentrancy guards** and real-time monitoring systems are essential to prevent such devastating attacks in the future. **Investigation by:** [**Tushar Tiwari**](https://in.linkedin.com/in/tushar-tiwari-1380271b7)**, Analyst @** [**Blockscope**](https://www.blockscope.co/)

**Disclaimer: Best Effort Investigation** This investigation and its findings represent our best effort based on the information available at the time. However, please be aware of the following limitations: * The data used in this investigation may contain inaccuracies, omissions, or errors. * Information sources may be incomplete or subject to change. * New evidence may emerge that could alter the conclusions. * Analysis and interpretations are based on current understanding and may evolve. We have made every reasonable attempt to ensure accuracy, but cannot guarantee that all information is entirely correct or complete. This report should be considered a snapshot of our current knowledge and understanding, subject to revision as new information becomes available. # Crypto Whale Sinks: $55.47M Phished Away from MakerDAO Vault ## **Summary and Highlights** On August 20th, 2024, a sophisticated phishing attack resulted in the theft of 55.47M DAI from a crypto whale’s wallet. The attack stemmed from an accidental signing of a malicious transaction, leading to the unauthorized transfer of control over the whale’s Maker Vault. The attacker altered the ownership of the DSProxy contract, redirecting the funds to their own wallet. Despite the whale’s attempts to recover the assets, the ownership had already been transferred, and the funds were quickly moved and swapped for 10,625 ETH. ### Relevant Addresses and Transactions: * **Victim Address:** 0xf2B889437F243396b29E829908b5d8ebE2e13048 * **Phishing Address:** 0x0000db5c8B030ae20308ac975898E09741e70000 * **Attacker's Withdrawal Address:** 0x5D4b2A02c59197eB2cAe95A6Df9fE27af60459d4 * **DSProxy Contract:** 0x2129F8a9b6C3092a600Da82Ce859B7A9a69983E4 * **Tx Hash:** 0xf70042bf3ae7c22f0680f8afa078c38989ed475dfbe5c8d8f30a50d4d2f45dc4 ## How did this Phishing Attack happen? The phishing attack exploited a minor oversight by the victim- signing an unknown transaction. This oversight granted the attacker the ability to change the ownership of the victim's DSProxy contract. The attacker then redirected the control to another address, which was used to funnel the 55.47M DAI and subsequently swap the stolen DAI for ETH using Cowswap. ### Decoding Transcations On delving deeper and decoding the transactions with Blockscope's Transaction Decoder, we got to observe how the ownership of the DSProxy contract changed and then how attacker drained all the funds.

#### 1. Changing the Ownership- 1:40 PM EST on 20th August, 2024 At 1:40 PM EST on 20th August, 2024, the attacker executed transaction "0xb721c8d603d5cbac826d 804b04fb4662952afe91af15cf2aa603d002d3410b87", successfully transferring ownership of the victim’s DSProxy contract to a phishing address. This ownership change was a critical step in taking control of the victim's assets.

Ownership transfer from Victim to Phishing Wallet

Later, at 5:34 PM EST, the victim attempted to execute a transaction on the DSProxy contract, but it failed since the ownership had already been transferred. This is confirmed by transaction "0x8ca26c07a33da122a145bbb28343f2b02fa02b3b4d4cba2cd82607207fa5dce6".

Transaction failed after change of Ownership

At 7:05 PM EST, the attacker further solidified control by changing the contract ownership once more, this time directing it to their designated withdrawal address. This set the stage for the eventual theft of the funds. Transaction "0x28054acca764c58157e1e5779e5e6d1c9c858a7508b189655d370a82e2a0e 07b" reflects this final ownership change.

Ownerhsip changed to Attacker's Withdrawl Address

#### 2. Draining Funds - 7:33 PM EST on August 20, 2024 Blockscope’s Transaction Decoder flagged the critical transaction "0xf70042bf3ae7c22f0680 f8afa078c38989ed475dfbe5c8d8f30a50d4d2f45dc4", which occurred at 7:33 PM EST, just 28 minutes after the final ownership change. This transaction allowed the attacker’s address to execute the DSProxy contract and transfer 55.47 million DAI.

Transfer from Burn to Attacker's Address

The flow of this key transaction is detailed below, which led to minting and withdrawal of 55.47M DAI.

The rapid sequence of events ensured that the attacker gained full access to the victim’s funds, allowing them to seamlessly mint and withdraw the DAI. ## Tracing Stolen Funds Our team meticulously visualized the flow of funds using Blockscope's Tracer. The DAI from the Maker Vault was funneled into the attacker’s wallet, followed by a conversion through Cow Swap. ### Part 1: Funds Movement to Cowswap The stolen DAI was converted to ETH through Cow Swap. The funds were initially channeled into the attacker’s wallet and then dispersed across multiple addresses.

### Part 2: Post Cowswap After the DAI was converted to ETH on Cow Swap, the attacker distributed the funds across several addresses.

Interestingly, one address labeled "**Post Cow Swap Attacker Address**" (0x1489d90a4f2bed2e1f2bed2e1f9503d416ab0aae13410b39 ) is still holding Eth worth $15,946,133.06 USD. Additional addresses holding significant amounts of ETH are listed below in later sections.

## Associated Addresses in the Attack A comprehensive list of associated addresses and their connections has been identified using Blockscope's Cohort Analyzer. This helps visualize the network of addresses involved in the attack and to determine the possible association between various addresses.

### List of Associated Addresses The table below demonstrates all the major addresses we found and labelled during the investigation of this Phishing Attack.

Identity	Detail	Address
Whale's Wallet (Victim)	Original owner of the Maker Vault	0xf2b889437f243396b29e829908b5d8ebe2e13048
Attacker Phishing Address	Phishing account that changed ownership of Maker Vault	0x0000db5c8B030ae20308ac975898E09741e70000
Attacker Withdrawl Address	Account used to withdraw minted 55.47M DAI	0x5D4b2A02c59197eB2cAe95A6Df9fE27af60459d4
DSProxy Contract	Proxy contract used to interact with Maker Vault	0x2129F8a9b6C3092a600Da82Ce859B7A9a69983E4
Post Cowswap ETH holder	Attacker address still holding Eth worth of $16.23M	0x1489d90a4f2bed2e1f9503d416ab0aae13410b39
Attacker Address 2	Used for tunneling and off boarding funds using Cowswap	0xdd6397104d57533e507bd571ac88c4b24852bce9
Attacker Address 3	Used for tunneling and off boarding funds using Cowswap	0xfb65a68d4583b6d3a61ccd90655c0b7b4677e9a6
Attacker Address 4	Used for tunneling and off boarding funds using Cowswap	0xc2cc41c4f0f9aa38cb1fa71c39da2121adfa5909
Attacker Address 5	Used for tunneling and off boarding funds using Cowswap & 1Inch Aggregator	0x8cc568f3565a7ed44b3b0af8765a7ef67b8bc2dc
Attacker Address 6	Used for tunneling funds	0x860cf33bdc076f42edbc66c6fec30aa9ee99f073
Attacker Address 7	Used for tunneling and off boarding funds using Cowswap	0x82c32f58ef59c84e74d0550f051cc86c6c5142f5
Attacker Address 8	Used for tunneling and off boarding funds using Cowswap	0xc9375fbfc0855b50316e68982001d5b7d0e9d028
Attacker Address 9	Used for tunneling and still holding 2M DAI	0x77b9f7e33e42b1f64b915bb27e9a9bca199da83e
Attacker Address 10	Account holding $726k worth of ETH	0xaa862f977d6916a1e89e856fc11fd99a2f2fabf8
Attacker Address 11	Account used for tunneling	0xba258b2b0afdbff8a6b4171f2da3ef1ae8071843
Attacker Address 12	Account holding $813k worth of ETH	0xbeda662dc22c972498a18cbddfb22b8ff9fde97c
Attacker Address 13	Account holding 165k DAI	0x42ee0f9adc79cbbffa626efa64d653808143e7ec
Attacker Address 14	Account holding 165k DAI	0xbcd0303e156942a04fa837cab52eb6bfd0b3ae3e

## Monitoring and Future Actions Blockscope’s Watchtowers are actively monitoring the identified attacker addresses mentioned above. Our team is also tracking the Post-Cow Swap Attacker Address and all the other holders, ensuring any further movement is detected in real-time. ## Notable Observations * **1Inch Aggregation:** Router V5 was also utilized alongside Cow Swap to obfuscate the funds. * **Communications** between the attacker, the victim, and a potentially related address indicate the possible involvement of a bounty hunter. This intermediary may be attempting to mediate or recover the stolen funds.

## Conclusion This incident underscores the severe risks associated with phishing attacks in the cryptocurrency space, particularly involving high-value assets. The attack exploited a minor security lapse—signing an unknown transaction—highlighting the critical need for vigilance and stringent security measures in managing crypto assets. **Investigation by:** [**Tushar Tiwari**](https://research.blockscope.co/crypto-whale-sinks-usd55.47m-phished-away/www.linkedin.com/in/tushartiwari21)**, Analyst @**[ **Blockscope**](https://www.blockscope.co/) For more information, please reach out to us at ****

On August 1 2024, the Convergence Finance Protocol on Ethereum was hacked through a smart contract vulnerability, resulting in nearly 58M unauthorized CVG Tokens being minted, worth nearly 210K USD at the time of the attack. ## Investigation Highlights Convergence Finance is a DeFi protocol that operates a set smart contracts that participate in various other protocols optimizing yield for the DeFi ecosystem. They incentivize users to participate in their protocol through the CVG token. The hacker was able to exploit a vulnerability in the rewards contract, where proper validation wasn't being done, this allowed the hacker to mint new CVG tokens. These tokens were then immediately swapped for more stable assets such as WETH and Curve.fi FRAX. Soon after the exploiter moved the funds to a well known and OFAC sanctioned mixer, Tornado cash, effectively making it impossible to track down the funds. The Convergence Finance team attempted to contact the exploiter to get their funds back and offering a bounty reward as well, but the money has so far not been returned. ## Hack Breakdown & Timeline? ### Thursday August 1, 10:55 UTC - Attaker's Wallet Funded The attacker's wallet, 0x03560a9d7a2c391fb1a087c33650037ae30de3aa (Convergence Exploiter), was funded with 0.9874 ETH (3.2K USD) from 0x912c705958f527b08289320c20ca6c90463ab572 (Convergence Exploit Funder).

Figure 1: Exploit Wallet Funding (Provided By Blockscope Wallet Profiler)

Looking further at Convergence Exploit Funder, we can see that they ultimately got their funds from Tornado cash about 2 minutes earlier.

Figure 2: Tornado Cash is the initial source of funds (Figure 1: Exploit Wallet Funding (Provided By Blockscope Wallet Profiler)

### Thursday August 1, 10:59 UTC - Exploit transaction triggered The attack transaction, 0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9 was executed. Looking at the transaction through Transaction Decoder's Trace call feature, it can be seen that the two smart contracts were created, since they came from the exploiter it can be assumed that they were malicious in nature. Eventually a call to the CVX Reward Distributor contract is made. This is likely where the attack occurs.

Figure 3: Attack Transaction Breakdown (Provided by Blockscope Transaction Decoder)

### Technical Breakdown of the hack Claiming tokens via smart contracts usually involves minting so looking at the token transfers table in the decoder tool, the mint information can be seen. Opening the event data, the trace id is shown as "Trace-6" so going back to Trace Calls, we can further investigate.

Figure 4: CVG Mint Record (Provided by Blockscope Transaction Decoder)

Figure 5: CVG Mint Details (Provided by Blockscope Transaction Decoder)

Trace Calls Line 6 Confirms the minting of tokens. Looking up the trace, it can be seen that Trace 4 is the initial trigger, confirming the earlier thesis.

Figure 6: CVG Mint Location in Transaction (Provided by Blockscope Transaction Decoder)

Looking at the decoded data on Trace 4, one of the malicious contracts pops up. The vulnerability can be localized to this function call.

Figure 7: CVG Mint Attack Details (Provided by Blockscope Transaction Decoder)

It is now evident that something occurred in this situation. Upon reviewing the code for the CVX Reward Distributor on Etherscan, particularly the `claimMultipleStaking` function, it became clear that within the function, a loop iterates over contracts to gather the amount of `cvgClaimable`. However, there were no checks in place to verify whether the contract was legitimate and eligible to claim rewards. The malicious contract was designed with a single function that returned the amount the attacker intended to mint. Essentially, any amount could have been specified as long as it passed the subsequent checks in the code.

From here, the tokens are swapped for WETH and Curve.fi FRAX. ## Tracing Funds Lets use the Blockscope Tracer tool and find where the funds came from and went. We start by searching the Exploiter's wallet and the tokens involved. ### Exploiter Offramping funds to Tornado The exploiter acted very quick to convert all the tokens to stable tokens (WETH, ETH) and the move them to Tornado Cash to hide their tracks.

Figure 9: Exploit Fund Trace (Provided by Blockscope Tracer)

The node on the very right is the Tornado Cash router, a smart contract where the majority of funds being laundered through Tornado Cash's protocol first go through. Expanding on the connection between the exploiter and the router, multiple transactions of ETH transfers can be seen. ### The Full Picture The tracer below brings in information from the exploit transaction. We can see 58M CVG tokens being minted, and moved to a contract funded by the attacker. Then 52M of those tokens go into a CVG/WETH Pool. The WETH is then swapped for ETH and we can see the WETH contract sending 60 ETH to the attacker's wallet. The other 6M token move to Curve.fi Contract and swapped for CRVFRAX. Finally the CRVFRAX was swapped for ETH using Cowswap. Last the total 65.8 ETH gets sent out to Tornado Cash

Figure 10: A breakdown of the whole exploit (Provided by Blockscope Tracer)

### Finding all the transactions to Tornado Cash Let use Entity Interaction and find all the transactions, between the attacker and Tornado Cash. A quick search gives us the findings, 19 transactions were triggered where the exploiter sent funds to Tornado Cash.

Figure 11: Summary of interactions between Exploiter and Tornado Cash (Provided by Entity Interaction)

Breaking this information down gives us all 19 of these transactions as seen in the image below.

Figure 12: Exploiter Sending Funds to Tornado Cash (Provided by Blockscope Entity Interaction)

Looking at all 19 of these transaction, the following information can be noted. 6 transaction were made moving 10 ETH each time into the 10ETH Tornado Pool. 5 transactions were made moving 1 ETH each time to the 1 ETH Tornado Pool. The remaining 8 transactions moved 0.1 ETH each time to the 0.1 ETH Pool. | Amount sent to Tornado | # of Txns | Total | | ---------------------- | --------- | ------- | | 0.1 ETH | 8 txns | 0.8 ETH | | 1 ETH | 5 txns | 5 ETH | | 10 ETH | 6 txns | 60 ETH | The funds are now mixed through Tornado Cash and hard to trace. However knowing the sums of the amounts moved into the mixer, we can potentially watch for accounts withdrawing these sums from the mixer. ## Recovery Attempt - Convergence Finance Communications The Convergence Finance Team attempted to make communications on two seperate occasions with the exploiter, asking for the money back. Both times they were ignored. From the last message it seems like they are now pursuing investigating the crime via other 3rd party firms. ### Communication 1: Tuesday Aug 6, 8:56 UTC The first message was sent via transaction: 0x0efb4ecda85da9883795a8cae60de7c54bd4ec549d85c6d67ef1df1fc16af7d7 demanding the return of the funds within 48 Hours. The message can be seen in the decoded view of the transaction.

Figure 13: First Attempt to Regain Funds (Provided by Blockscope Wallet Profiler)

### Communication 2: Thursday Aug 8, 15:04 UTC After the first 48 hours, they again sent a message via transaction: 0x4f63017dab0f53614a40957da60361074c58221e1c00e29b235325c6204fa5d7 with another 24 hour time limit along with a 10% bounty reward, with the threat of legal action.

Figure 14: Last Attempt to Regain Funds (Provided by Blockscope Wallet Profiler)

### Communication 3: Sunday Aug 11, 15:09 UTC After another 3 days, they send a message claiming the convergence team will use legal means to pursue the exploiter in the following transaction: 0xa7be1dd82569634a7aaa72bf083558a2bada949d20effefcacb020334ee18777

Figure 15: Convergence team notifying the exploiter about legal action (Provided by Blockscope Wallet Profiler)

## Wallets & Transactions involved in Exploit ### Addresses of Note | Name | Address | Notes | | ---------------------------------- | ------------------------------------------ | ----------------------------------------------------------------- | | Convergence Team Messenger | 0xfffde9a2bb7c9a6dfd1f0235f5af4f599e3265ec |

Account Convergence Team used to message the exploiter

| | Convergence Exploiter | 0x03560a9d7a2c391fb1a087c33650037ae30de3aa | | | Malicious Contract | 0xee45384d4861b6fb422dfa03fbdcc6e29d7beb69 | Exploiter contract that gave bad data to the reward contract | | Convergence Finance Exploit Funder | 0x912c705958f527b08289320c20ca6c90463ab572 | Origin of funds for the exploit | | Cvx Reward Distributor | 0x2b083beaac310cc5e190b1d2507038ccb03e7606 | Contract that was hacked | ### Transactions of Note | Transaction Hash | Date | Notes | | ------------------------------------------------------------------ | ------------------------------------- | ------------------------------------------------------------------------------------------- | | 0x849f2ac1c3bfa3d8e644e21c39c9a23301dcbeb600739529cd8b4554cf4e5dc8 |

10:55 AM

Thu Aug 01 2024

| Funding Transaction of Exploiter | | 0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9 |

10:59 AM

Thu Aug 01 2024

| Attack Transaction | | 0x0efb4ecda85da9883795a8cae60de7c54bd4ec549d85c6d67ef1df1fc16af7d7 |

08:56 AM

Tue Aug 06 2024

| Convergence To Exploiter demanding contact in 48 hours | | 0x4f63017dab0f53614a40957da60361074c58221e1c00e29b235325c6204fa5d7 |

03:04 PM

Thu Aug 08 2024

| Convergence to Exploiter Message to show 48 hours up. 24 Hours extra added, plus 10% bounty | ## Summary The investigation utilized several advanced tools provided by Blockscope and forensic techniques to meticulously trace and analyze the events of the hack: * Transaction Decoder: Essential in breaking down unauthorized transactions and understanding the sequence of actions taken by the hackers. * Wallet Profiler: Helped identify and analyze the suspicious wallets involved, revealing their connections to the Tornado Cash mixer, which was used to obfuscate the origins of the stolen funds. * Tracer Tool: Played a crucial role in tracking the movement of the stolen tokens, such as SHIB and ETH, across various wallets and DeFi protocols. * Entity Interaction Tool: Used to map out all interactions between the involved addresses. * Cohort Analyzer: Helped identify clusters of associated wallets, providing a clearer picture of the hackers' network. For more information, please reach out to us at **** Disclaimer: Best Effort Investigation This investigation and its findings represent our best effort based on the information available at the time. However, please be aware of the following limitations: * The data used in this investigation may contain inaccuracies, omissions, or errors. * Information sources may be incomplete or subject to change. * New evidence may emerge that could alter the conclusions. * Analysis and interpretations are based on current understanding and may evolve. We have made every reasonable attempt to ensure accuracy, but cannot guarantee that all information is entirely correct or complete. This report should be considered a snapshot of our current knowledge and understanding, subject to revision as new information becomes available.
# WazirX $235M Exploit

A view of some of the addresses associated with WazirX Exploiter and their interactions

## Investigation Highlights Recently, WazirX, a prominent Indian cryptocurrency exchange, experienced a major security breach resulting in the theft of approximately $235 million worth of crypto assets. The hack targeted one of the exchange's multisig (multisignature) wallets. WazirX uses Liminal, a digital asset custody solution for institutions. A multisig wallet is a type of cryptocurrency wallet smart contract that requires multiple private keys to authorize a transaction. This setup enhances security by ensuring that no single party has complete control over the wallet's funds. In the context of WazirX, their multisig wallet required signatures from three WazirX team members and one from Liminal to authorize transactions. This setup was meant to enhance security by distributing control among several parties The hackers exploited a flaw in the Liminal user interface, allowing them to compromise multiple signatures. This enabled them to perform an unauthorized code change to the smart contract controlling the wallet, ultimately draining the wallet of its funds. In response to the attack, WazirX temporarily suspended withdrawals to prevent further losses and initiated an investigation into the incident. As of the writing of this report, the stolen funds account for over 45% of the exchange’s $500 million holdings reported in June. The stolen assets included significant amounts of SHIB, ETH, MATIC, PEPE, USDT, and GALA. The hackers have already begun liquidating some of these assets, causing market disruptions, such as a notable drop in the price of SHIB. ## How did this hack happen? The root of this exploit lay in the hackers' ability to discover and/or phish most of the signatures needed to gain entry to WazirX's multisig wallet. Initially the hackers were able to compromise the Liminal Custody UI. This allowed them to set up a normal-looking transaction for a USDT transfer on the website. However, in reality, the hackers were using this fraudulent transaction to steal the necessary signatures for the next stage of the attack. The hackers were meticulous in their approach, using wallets funded via the Tornado Cash mixer to obscure any potential Know Your Customer (KYC) information that other exchanges might have on them.These newly created wallets were then used to deploy a malicious contract. The hackers then upgraded WazirX’s multisig wallet to their malicious contract, ultimately gaining control over the account. Once they had control, the hackers drained the wallet and began using various decentralized finance (DeFi) protocols to sell and swap the stolen tokens for ETH. This method not only facilitated the liquidation of the assets but also helped in further obfuscating the trail of the stolen funds. ## Hack Breakdown & Timeline ### July 10, 2024 - Between 2:28 AM and 2:41 AM ET Address 0x6eedf92fb92dd68a270c3205e96dccc527728066 (WazirX Exploiter 0) funded from Tornado Cash 0.1 ETH Pool via 5 different transactions

Image 1 provided by Blockscope Tool - Wallet Profiler

Image 1 illustrates the transactions used to fund the WazirX hacker's wallet. The funds originated from Tornado Cash, a privacy protocol sanctioned by the U.S. in August 2022 due to its misuse for mixing tokens and facilitating money laundering. The use of Tornado Cash indicates nefarious behavior, as it likely served to obfuscate the source of the funds.

Image 2 provided by Blockscope Tool - Wallet Profiler

Image 2 indicates this wallet is funded by a Mixer, has high risk and was only active between July 10 and July 22. This address also has more than 100 interactions that took place within the 12 days. ### July 10, 2024 - 3:37 AM ET Exploit contract 0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2 (WazirX Exploit contract) created by ‘WazirX Exploiter 0’, screenshot of this transaction is shows below.

Image 3 provided by Blockscope Tool - Wallet Profiler

### July 18, 2024 - 2:17 AM ET Transaction 0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d was triggered. This transaction allowed the exploiters to take control of the wallet’s smart contract code and upgrade it to an unauthorized contract (0xef279c2ab14960aa319008cbea384b9f8ac35fc6) with logic that was not intended by the WazirX or Liminal team. Note, There were two exploit smart contracts. 1, to upgrade the smart contract logic (ending in caf2) and the other that contains the smart contract logic (ending in 5fc6) Image 4 illustrates the the individual steps (or sub-transactions) that took place in order to upgrade and inject the hacker’s contract 0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2 (as seen in the bottom right of the image) and get control of WazirX’s multisig wallet. To execute this transaction successfully, a majority of the signatories on the wallet would be needed, in this case 4 out of 6 signers would be needed. It is speculated that the hackers have compromised two signatures and phished two more signatures. For more details on the technical breakdown, please reach out at

Image 4 provided by Blockscope Tool - Transaction Decoder, trace call breakdown

### July 18, Between 2:19 AM ET - 3:32 AM ET Wallet Draining - 199 token transfers were sent from WazirX’s multisig wallet to exploiter wallet. Totaling to about 235M USD worth of tokens being drained in just over an hours worth of time

Image 5 provided by Blockscope Tool - Entity Interaction

Image 5 demonstrates how Blockscope’s Entity Interaction Tool can be used to export every transaction between these 2 wallets. This makes it very easy for us to identify and extract all necessary interactions between the 2 entities thus helping find every token that was drained from the multisig wallet to the hacker’s wallet. \ Further analyzing the data provided by the Entity Interaction tool, we see the top 5 tokens moved out make up about $180M USD worth. The remaining tokens make us the other 55M, which was about 194 other transactions. | Token | Amount | USD Value when hacked | | ----- | --------------------------- | --------------------- | | SHIB | 5,433,752,465,343.2161 SHIB | $102.1M USD | | ETH | 15,298.1621 ETH | $52.5M USD | | MATIC | 20,501,141.1328 MATIC | $11.2M USD | | PEPE | 640,269,599,061.044 PEPE | $7.62M USD | | USDT | 5,792,698.5554 USDT | $5.79M USD | Table 1 shows some of the top tokens that were drained, how many, and its USD value during the day of the hack ## Tracing Funds Between July 18, 2024 - July 22, 2024 the exploiter had started moving large amounts of tokens into different wallets. Using Blockscope’s Tracer tool we can start to see where funds are being moved and find all associated wallets involved. ### Tracing $100M USD worth of SHIB We started tracing the top tokens moving out from WazirX’s multisig into the exploiter. Since the amount of SHIB stolen was the largest, we start with this token. The image below shows all the SHIB moving into another account, labeled by us as ‘WazirX Exploiter 2’.

Image 6 provided by Blockscope Tool - Tracer

Image 6 illustrates the 5.4 billion SHIB tokens and where they were moved. Blockscope’s Tracer tools lets us easily track the fonts to its final destination.

Image 7 provided by Blockscope Tool - Tracer

Image 7 demonstrates the results if we continue to follow the SHIB tokens. We can see all the other associated accounts where this token was moved. Many of these wallets are currently still holding the SHIB, or have started using other services such as DeFi protocols to exchange the SHIB for different tokens.

Image 8 provided by Blockscope Tool - Tracer

We eventually follow the tracer to a point where these wallets are now using DeFi protocols like 1inch or Uniswap to move and swap SHIB into ETH. We can now utilize Blockscope’s Watchtower tool to further monitor these accounts for new transactions and get alerted when the funds move again. ### Tracing $50M USD worth of ETH We can apply the same strategy as above and track where the other tokens have been moved, let's trace where the $50M worth of stolen ETH went. We quickly find the wallet that currently holds most of the stolen ETH. For whatever reason, the hackers have not moved the ETH out to other wallets or even attempted to send it out to mixers like Tornado Cash or other privacy focused protocols that may obfuscate where these funds will go.

Image 9 provided by Blockscope Tool - Tracer

Almost all of the stolen 15K ETH worth about $50M USD remains in the wallet highlighted in green, as shown in Image 9.

Image 10 provided by Blockscope Tool - Wallet Profiler

Further analyzing the wallet (0x58d3b2fd2ce20a7149244d7e34d18b9b55448e7a) with $50M worth of ETH in Blockscop’s Wallet Profiler. We can see the user has not triggered any outbound transaction and still currently holds all the ETH they have received. ### Continuing the Tracing We can continue tracing all the other tokens that were stolen in a similar fashion and find a set of associated addresses that may help us track down additional information about the hackers. ## Where are funds being Offboarded? In our investigation we found the attackers have already used some of the most popular DeFi protocols and smart contracts to move and swap out tokens. Some of the protocols used are the following, this is not an exhaustive list, only the most common protocols: * Uniswap V3 * Cowswap * Kyber Swap * 1inch * SushiSwap

Image 11 provided by Blockscope Tool - Wallet Profiler

In Image 11 above, we examine one of the exploiter's addresses we identified—0x6ea4cd20a0930eaf5b0bc097238ceaf9008703d5—using Tracer. By searching this address in the wallet profiler, we can see their primary interactions with various DeFi protocols, where they are exchanging stolen funds for other tokens. The address has numerous transactions with Sushiswap, Kyberswap, and Uniswap. \ We can take all the associated addresses we have found so far using Blockscope’s Tracer tool and pull it into Blockscope’s Cohort Analyzer tool. This can give us all the relevant transactions amongst associated addresses. In the example below we will look at how the different WazirX hacker wallets we have discovered are all using 1Inch to swap out the stolen tokens.

Image 12 provided by Blockscope Tool - Cohort Analysis

In Image 12 above, we observe all outbound transactions from 1Inch to the various hacker wallets we have identified. Clicking on the edge will reveal the number of interactions. For instance, the image shows that there were 34 outbound transfers of different tokens between 1Inch and another WazirX hacker wallet. We can then use Blockscope’s Entity Interaction tool to locate all 34 of these transactions. \ Confirming Associated Addresses ------------------------------- Tracing funds can easily help us find addresses that are used to move money around and using heuristics and logic we can often deduce which addresses probably belong to the same entities. Another one of Blockscope’s forensics tools - cohort analyzer, can take a set of addresses and find connections amongst them to help determine if addresses are likely associated.

Image 13 provided by Blockscope Tool - Cohort Analysis

In image 13, we can see all the interactions between some of the addresses we discovered in this exploit. “WazirX Exploiter 1” which drained the “WazirX Gnosis Safe” multisig wallet and moved all the funds to the “WazirX Exploiter 2” wallet. This wallet is the focus node in the image, with all its adjacent nodes with a blue border. Many of these addresses are moving tokens amongst each other. ### List of Associated Addresses The following is a non-exhaustive list based on Blockscope’s findings on other wallets belonging to the WazirX Hacker and other prominent contracts/addresses involved in this exploit. | Identity | Notes | Address | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------ | | WazirX Multisig Wallet (Victim) | Multisig account that was the victim of this attack | 0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4 | | WazirX Exploiter 0 | Account that was used to set up malicious contract | 0x6eedf92fb92dd68a270c3205e96dccc527728066 | | WazirX Exploiter Contract | Contract deployed by WazirX Exploiter 0, to upgrade the smart contract logic of the multisig wallet | 0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2 | | WazirX Exploiter Draining Logic Contract | Contract deployed by WazirX Exploiter 0 that contains actual fund draining logic | 0xef279c2ab14960aa319008cbea384b9f8ac35fc6 | | WazirX Exploiter 1 | Account that immediately received all the drained funds | 0x04b21735e93fa3f8df70e2da89e6922616891a88 | | WazirX Exploiter 2 | All 15k stolen ETH stored at this wallet | 0x35febc10112302e0d69f35f42cce85816f8745ca | | WazirX Exploiter 3 - ETH Holder | Received all the 5.4B stolen SHIB | 0x361384e2761150170d349924a28d965f0dd3f092 | | WazirX Exploiter 4 | Wallet used to swap stolen tokens into ETH using DeFi protocols | 0x6ea4cd20a0930eaf5b0bc097238ceaf9008703d5 | | WazirX Exploiter 5 | Wallet used to swap stolen tokens into ETH using DeFi protocols | 0x1957a4c3d2edcb893c9b85833a417ea035d3aed7 | | WazirX Exploiter 6 | Wallet holds about 2.6k ETH worth $9M USD, most of this ETH was gained by swapping other stolen tokens | 0x668399a6604c41d46c81430e4dff71443d44efe6 | | WazirX Exploiter 7 - Tunnel Wallet | Wallet used to Tunnel stolen ANKR tokens | 0xc63dd6d4efe063807a521ebcbff6c61cd786b2e9 | | WazirX Exploiter 8 - Tunnel Wallet | Wallet used to Tunnel stolen SHIB tokens | 0x231e2547ca75b8f9e22be1b45845db07300cf9b4 | | WazirX Exploiter 9 - Offboarding Wallet | Wallet used to offboard stolen SHIB tokens using DeFi protocols | 0x0cffef1c95e280abc2ff1c44693eee19de921093 | | WazirX Exploiter 10 - Offboarding Wallet | Wallet used to offboard stolen SHIB tokens using DeFi protocols | 0x313f7c62b4ac4377ebd69fcebbb484a26faef678 | | WazirX Exploiter 11 - Tunnel Wallet | Wallet used to Tunnel 1.5B stolen SHIB tokens | 0x62b4daa783bb22cf45b6524c63c0477ee10b215f | | WazirX Exploiter 12 - Tunnel Wallet | Wallet used to Tunnel 1.2B stolen SHIB tokens | 0x252bdaaee67e3a94d80c98b22b6e85c2e4a86e56 | | WazirX Exploiter 13 - Tunnel Wallet | Wallet used to Tunnel 1.2B stolen SHIB tokens and offboard stolen SHIB tokens using DeFi protocols | 0x6ad4486edfbceafc170c3dd7762e8be1ddae12c2 | | WazirX Exploiter 14 - Offboarding Wallet | Wallet used to swap SHIB into ETH | 0x2d8231e7cb5d21887f0b007878a4bdd8b1a9c0e4 | | WazirX Exploiter 15 - Offboarding Wallet | Wallet used to Tunnel 135M stolen GALA tokens and offboard stolen GALA tokens using DeFi protocols | 0x90ca792206ed7ee9bc9da0d0df981fc5619f91fd | | WazirX Exploiter 16 - Offboarding Wallet | Wallet used to swap SHIB using DeFi protocols | 0x8f5376c6eddc246d7e57040b1b0647fd3cbaff89 | | WazirX Exploiter 17 - Offboarding Wallet | Wallet used to swap SHIB using Uniswap and other DeFi protocols | 0x57949b506d895d9ededdd9883bc301a820fdd063 | | WazirX Exploiter 18 - Offboarding Wallet | Wallet used to swap stolen tokens using Uniswap and other DeFi protocols | 0xb8343bcc0256aa2d11022f12941c40c9822b6afb | | WazirX Exploiter 19 - Offboarding Wallet | Funded by WazirX Exploiter 2, Wallet used to swap stolen tokens into ETH using DeFi protocols | 0xfae288c79c337e7f55db70abe85d39b59ed130ea | Table 2 Lists associated addresses found for the WazirX hacker during Blockscope’s investigation \ Monitoring Stolen Funds ----------------------- Using Blockscope’s monitoring tool, Watchtower, we can set up alerting whenever any of these stolen tokens move in or out of the wallets listed above. Link to see any new transactions captured by watchtower: [**https://www.blockscope.co/community/watchtowers/66a6c4126e96e8085fa4fed0**](https://www.blockscope.co/community/watchtowers/66a6c4126e96e8085fa4fed0)

Image 14 provided by Blockscope Tool Watchtower- WazirX Watchtower, monitoring all the hacker associated addresses we found

This watchtower captured the hacker moving the stolen funds out to Tornado Cash, an OFAC sanctioned protocol in real time, tracing these movements using Blockscope's Tracer tool gives the following insights.

Image 15 provided by Blockscope Tool Tracer - Shows how the hacker funneled the funds into Tornado Cash

## Summary The WazirX hack investigation is ongoing, with new details becoming public daily. This is Blockscope’s best effort analysis based on the data available on the Ethereum Blockchain and other publicly accessible sources at this time. The investigation utilized several advanced tools provided by Blockscope and forensic techniques to meticulously trace and analyze the events of the hack: * Transaction Decoder: Essential in breaking down unauthorized transactions and understanding the sequence of actions taken by the hackers. * Wallet Profiler: Helped identify and analyze the suspicious wallets involved, revealing their connections to the Tornado Cash mixer, which was used to obfuscate the origins of the stolen funds. * Tracer Tool: Played a crucial role in tracking the movement of the stolen tokens, such as SHIB and ETH, across various wallets and DeFi protocols. * Entity Interaction Tool: Used to map out all interactions between the involved addresses. * Cohort Analyzer: Helped identify clusters of associated wallets, providing a clearer picture of the hackers' network. For more information, please reach out to us at **** Disclaimer: Best Effort Investigation This investigation and its findings represent our best effort based on the information available at the time. However, please be aware of the following limitations: * The data used in this investigation may contain inaccuracies, omissions, or errors. * Information sources may be incomplete or subject to change. * New evidence may emerge that could alter the conclusions. * Analysis and interpretations are based on current understanding and may evolve. We have made every reasonable attempt to ensure accuracy, but cannot guarantee that all information is entirely correct or complete. This report should be considered a snapshot of our current knowledge and understanding, subject to revision as new information becomes available.

# SIR Protocol Exploit: Analyzing the Transient Storage Vulnerability

A view of addresses associated in SIR exploit.

## Summary [On March 30, 2025, the SIR Trading protocol, an Ethereum-based leveraged trading protocol, was exploited](https://x.com/leveragesir/status/1906320010210902298), resulting in a loss exceeding $360,000 in multiple assets like USDC, wETH, and wBTC. This attack marks one of the earliest exploits leveraging Ethereum’s transient storage feature. Understanding this incident is critical for developers, security researchers, and stakeholders in the blockchain community to prevent similar vulnerabilities in future implementations. ### About SIR Trading [**SIR Trading**](https://x.com/leveragesir) **(Synthetics Implemented Right)** is a leveraged trading platform built on Ethereum that [launched on February 20, 2025](https://x.com/leveragesir/status/1892712271110975554). The protocol allows users to mint leveraged tokens backed by collateral, interacting primarily with [Uniswap V3](https://blog.uniswap.org/uniswap-v3) for token swaps. Despite promising innovation, the project operated on limited resources, having raised only $70,000 from supporters on Twitter, facilitating a [single security audit conducted by Egis Security ](https://github.com/Egis-Security/audits/blob/main/reports/SIR-Trading.pdf)before the exploit. ### Initial Reporting and Founder Reaction The exploit was first flagged on X (formerly Twitter) by Web3 security firms such as [TenArmorAlert](https://x.com/TenArmorAlert/status/1906268185046745262) and [Decurity](https://x.com/DecurityHQ/status/1906270316935942350), who identified abnormal activity and began publicly analyzing the situation. Shortly after, the founder of SIR Trading, [**Xatarrer**, acknowledged the exploit ](https://x.com/Xatarrer/status/1906272345490407763)and confirmed that the protocol’s total TVL—over $360,000—had been drained. [Xatarrer responded with visible distress, offering a $100,000 bounty to the attacker ](https://x.com/leveragesir/status/1906700496607248812)in hopes of retrieving a portion of the lost funds. The attack highlighted the devastating impact of inadequate security practices.

Later, [SlowMist published a detailed technical report](https://slowmist.medium.com/fatal-residue-an-on-chain-heist-triggered-by-transient-storage-10909e4a255a) analyzing the root cause of the exploit and confirming the misuse of Ethereum’s transient storage feature. ### Major Addresses Involved * **Exploiter Wallet:** `0x27defcfa6498f957918f407ed8a58eba2884768c` * **Victim (Vault) Contract:** `0xb91ae2c8365fd45030aba84a4666c4db074e53e7` * **Malicious Contract (Deployed via CREATE2):** `0x00000000001271551295307acc16ba1e7e0d4281` * **Token A :** `0xea55fffae1937e47eba2d854ab7bd29a9cc29170` ### Prerequisite Knowledge To fully understand this exploit, one must be familiar with Ethereum's storage mechanisms, especially with EIP-1153. Previously, smart contracts primarily relied on **`SSTORE`** and `SLOAD` for storing and retrieving data. These operations were permanent and expensive, consuming significant gas due to their long-term persistence on-chain. [**Ethereum's Dencun upgrade introduced transient storage via EIP-1153**](https://medium.com/@organmo/demystifying-eip-1153-transient-storage-faeabbadd0d)**,** providing temporary, low-cost storage limited to a single transaction. Operations like `TSTORE(key, value)` temporarily storing data, while `TLOAD(key)` retrieves this data within the same transaction. Crucially, transient storage automatically resets after transaction completion, significantly lowering costs but introducing complexity that can be exploited if mismanaged. ## Decoding the Exploit The exploit was a direct result of the Vault contract's improper handling of transient storage. Initially, the **Victim (Vault) contract** `0xb91ae2c8365fd45030aba84a4666c4db074e53e7` utilized a transient storage slot `0x01` to store the address of the Uniswap V3 liquidity pool `0xe4c684f944b26b21167ef5a25f52311ab7822831` , created by the exploiter during token swap operations. However, the same transient storage slot was later reused within the same transaction to store the mint amount of tokens, effectively overwriting the initial pool address. In simple terms, the vulnerable contract was initially executed `TSTORE(0x01, poolAddress)` to temporarily store the Uniswap pool address. Later in the same transaction, the code performed another `TSTORE(0x01, amount)` operation on the same storage slot, `0x01`. As a result, the verification logic within the `uniswapV3SwapCallback()` function, `require(msg.sender == TLOAD(0x01))`; no longer retrieved the intended pool address, but instead retrieved the mint amount value.

UniswapV3 pool created by the exploiter is stored in transient storage

The attacker exploited this oversight by calculating the exact mint amount `95759995883742311247042417521410689` to match a specific Ethereum address. This involved brute-forcing a vanity Ethereum address `0x00000000001271551295307acc16ba1e7e0d4281` labelled as **Malicious contract** to precisely equal this numerical value. Then, by deploying the Malicious contract at this exact address using Ethereum's `CREATE2` opcode, the attacker perfectly matched the overwritten transient storage value. Then, it set up Token A by injecting a final minting amonut `1337821702718000008706643092967756684847623606640` , which is stored in the transient storage third time. With this setup, the attacker called the vulnerable Vault function `uniswapV3SwapCallback()` directly from their Token A contract. Since `msg.sender` it matched the overwritten transient storage value, the security and caller check mistakenly passed, allowing the attacker to impersonate the legitimate Uniswap pool and enabling unauthorized transfers of funds from the Vault.

The flowchart shows a high-level view of how the exploiter injected the vanity address using Create2 opcode, which is **used** `uniswapV3SwapCallback` to bypass pool verification in the Vault (Victim Contract) via transient storage manipulation. This enabled the minting of tokens and granted Token A contract, which was the full transactional control during the exploit.

Final minted value being set by Token A contract for the final caller check of transient storage.

Following this, the attacker repeatedly triggered swap callbacks and mint operations, leveraging the manipulated identity check to mint APE tokens and extract assets from the Vault. Each interaction allowed the attacker to further drain USDC, WBTC, and wETH, which were then swapped into wETH eventually using ParaSwap and Odos. Ultimately, the attacker routed the stolen funds into Railgun, a privacy-focused protocol, effectively concealing the transaction trail and making on-chain recovery more difficult. ### On-Chain Activity To better understand the exploit from an on-chain perspective, we analyzed it using Blockscope’s Tracer tool. The first trace (Tracer 1) captures the exploit in action—showing how the attacker triggered the vulnerable `uniswapV3SwapCallback` function and initiated unauthorized token transfers from the Vault. The below attacker shows the various contracts and addresses involved during the exploit.

Tracer 1 visualizes the complete exploit path, including all key transactions and the nodes (addresses and contracts) involved in executing the attack.

The second trace (Tracer 2) highlights the post-exploit fund flows, revealing how the attacker swapped, consolidated, and routed stolen asset into Railgun, a privacy-focused protocol, effectively obfuscating their origin and movement.

Tracer 2 illustrates the post-exploit flow, showing how the attacker swapped USDC and WBTC into WETH before depositing the consolidated funds into Railgun for obfuscation.

## Timeline and Breakdown ### 30 January 2025 at 6:18 UTC The Exploiter `0x27defcfa6498f957918f407ed8a58eba2884768c` deployed two malicious ERC20 tokens: Token A `0xea55fffae1937e47eba2d854ab7bd29a9cc29170` and Token B `0x341c853c09b3691b434781078572f9d3ab9e3cbb`. Subsequently, the attacker created a liquidity pool for these tokens on Uniswap V3 to establish credibility within the Vault system. **Token A creation tx:** `0xa0b04f968ddafd059bee3f97c2f1af9b77ef41a4c402486985dd6c424c579291` **Attack tx:** `0xa05f047ddfdad9126624c4496b5d4a59f961ee7c091e7b4e38cee86f1335736f`

### 30 January 2025 at 6:21 UTC The Exploiter invoked the Vault's initialization function `initialize` to create a leveraged trading market named "**APE-21**", explicitly setting Token A as collateral and Token B as debt tokens. Attack tx: `0xa05f047ddfdad9126624c4496b5d4a59f961ee7c091e7b4e38cee86f1335736f`

Decoded trace call showing Vault initialization taken place

The attacker then executed a mint operation through the Vault's mint function (`mint`). Initially, a transient storage slot `0x01` was correctly used to temporarily store the address of the Uniswap V3 liquidity pool `0xe4c684f944b26b21167ef5a25f52311ab7822831`. However, within the same mint function, the Vault contract mistakenly overwrote this slot with the mint amount (`95759995883742311247042417521410689`).

Transaction log showing Mint function being called by Exploiter on Vault

Leveraging Ethereum's deterministic deployment capability (`CREATE2`), the attacker deployed a malicious contract precisely at address `0x00000000001271551295307acc16ba1e7e0d4281`, matching the overwritten transient storage slot.

Trace call shows Exploiter deploying Malicious contract

The attacker also had pre calculated the final minted value, which set the Token A contract as the caller in the last Transient storage, which called the Vault's callback function (`uniswapV3SwapCallback`). Due to the transient storage vulnerability, the security check incorrectly verified the Token A and Malicious contract as legitimate, enabling unauthorized token transfers.

uniswapV3SwapCallBack function is being called, and Malicious contract, which is being called by Token A contract passes all security checks due to transient storage vulnerability

USDC being transferred to the main exploiter wallet

Trace call shows using uniswapV3CallBack function, Exploiter drained USDC, wBTC and wETH.

### January 30 2025 at 6:25 UTC Finally, the attacker converted the stolen tokens (WBTC and USDC) into WETH and consolidated the assets. These funds were then routed into Railgun, a privacy-enhancing protocol, effectively obfuscating their trail and complicating recovery efforts.

Token Transfer from Transcation Decoder shows Exploiter used Odos and ParaSwap to convert wBTC and USDC into ETH

## Cohort Analysis A detailed **cohort analysis** revealed 49 interactions between the exploiter-associated addresses and the Victim (Vault) contract—all occurring within a **single transaction**. This level of coordination reflects meticulous pre-planning and execution, leveraging Ethereum’s deterministic behavior and the transient storage vulnerability with surgical precision.

Cohort Analysis of the Victim and Exploiter Addresses

### Conclusion This exploit highlights the urgent need for thorough and repeated security audits, especially when adopting innovative blockchain features such as transient storage. The founder's distress and immediate reaction—offering a $100,000 bounty to the attacker—underscores the significant damage insufficient security practices can inflict on blockchain projects.

On-chain message sent by SIR to Exploiter. **Tx. hash: `0x0ffcbb86700e0ebb5ee0c3fd46b81c943a5027cc68738cbb17d364f893f31018`**

Relying on a single audit while handling user funds proved to be a costly mistake for SIR Trading—and a cautionary tale for the entire ecosystem. Web3 forensics and monitoring platforms like [**Blockscope**](https://www.blockscope.co/) are essential in equipping users, businesses, and law enforcement with the tools needed to trace, prevent, and respond to exploits. In the crypto space, **security should no longer be optional**—projects must take greater accountability and prioritize proactive investment in security from day one. **Investigation by:** [**Tushar Tiwari**](https://in.linkedin.com/in/tushar-tiwari-1380271b7)**,** Analyst @ [**Blockscope**](https://www.blockscope.co/) For more information, please reach out to us at ****

Initial view of the search results of the txn that moved money out of Houbi Global

Through a quick examination of the decoded transaction, we have successfully pinpointed the compromised HTX Hot wallet, as well as the designated recipient wallet utilized by the HTX Hacker to receive the 4,999 ETH. These wallets are as follows * 0x2abc22eb9a09ebbe7b41737ccde147f586efeb6a [(Attacked HTX Hot wallet)](https://etherscan.io/address/0x2Abc22eb9A09EbBE7b41737CCde147F586EfeB6A) * 0xdb1d74467c9042517a354304256e0d658d8aec83 [(HTX Global Hacker 1)](https://etherscan.io/address/0xdb1D74467c9042517A354304256E0d658D8AEC83) ### Step 2 - Tracer Following our successful identification of these addresses, we are can now do a deep dive on he addresses involved by using Blockscope’s Tracer Tool. This tool is enables users to track and visualize the movements of funds across various wallets on the blockchain. Tracer equips users with a comprehensive view of token flow, enabling the identification of potentially suspicious transactions, and thereby enhancing their investigative capabilities.

We can see the transaction moving out almost 5k ETH to a new wallet

Right away, we have verified the outflow of the reported 4,999 ETH from 0x2abc22eb9a09ebbe7b41737ccde147f586efeb6a (The compromised HTX hot wallet) to 0xdb1d74467c9042517a354304256e0d658d8aec83 (HTX Global Hacker 1). Lets see where the funds went from here. Further expanding on the Hackers wallet shows us he initially moved 1001 ETH to a new wallet. But eventually moved it all to the Houbi Recovery wallet

Next expanding on the Houbi Recovery Wallet, we can see 5% payment of 250 ETH was made to the white hacker's wallet and the remaining funds were moved out by Houbi to what we can assume is another one of their accounts.

### Step 3 - Wallet Profiler We know the address of the account that received the reward funds of 250 ETH. Using Blockscope's Wallet Profiler tool confirms 2 things, the funds are still there and the user has not triggered any transactions moving funds out.

Current holding of the wallet with reward funds

No outbound transaction have been triggered.

### Step 4 - Monitor with Watchtower We have the opportunity to see how these funds move into the future. We will use the watchtower tool and set up monitoring on this wallet. If any of these funds move, we will know in realtime!

## Summary The hacker was sucessfully able to steal funds from one of HTX(Houbi)'s Hot Wallets. They then moved the funds back into Houbi Recovery wallet. As a result, they earned 5% about 250 ETH worth 400,000 USD. These funds are still in their wallet, we've set up monitoring so if the funds move again, we'll know in realtime! # The Legal Pursuit of Andean Medjedovic

## Introduction On February 3, 2025,[ the U.S. Department of Justice (DOJ) unsealed a five-count indictment](https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes) against Andean Medjedovic, a 22-year-old Canadian national, for orchestrating two major decentralized finance (DeFi) hacks—[Indexed Finance ](https://x.com/ndxfi?lang=en)(2021) and [KyberSwap](https://x.com/KyberNetwork?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) (2023). Medjedovic allegedly exploited smart contract vulnerabilities and engaged in deceptive trading practices to siphon approximately $65 million in digital assets. His case has reignited debates on DeFi regulation, security, and ethical accountability, questioning [whether "code is law" absolves exploiters](https://blockworks.co/news/canadian-15-8m-defi-theft-case-could-upend-code-is-law-convention) of legal consequences or if such actions should be prosecuted under existing financial laws.

Arguments from 2021 on whether 'Code is Law' applies in unregulated markets

In addition to criminal charges in the U.S., Medjedovic faces a class-action lawsuit in Canada, further intensifying discussions around the legal and ethical implications of exploiting DeFi protocols. As law enforcement agencies worldwide seek his arrest, his case is shaping the future of DeFi security and legal frameworks. ## Who is Andean Medjedovic? A former student at the University of Waterloo and a recognized mathematics prodigy, Andean Medjedovic demonstrated exceptional problem-solving skills from a young age. At 19, Medjedovic earned a master’s degree in mathematics from the University of Waterloo, [per Ontario court documents](https://www.canlii.org/en/on/onsc/doc/2021/2021onsc369/2021onsc369.html), and while still a student, he allegedly executed the Indexed Finance exploit in October 2021, capitalizing on a vulnerability in the protocol’s price oracle system. Through a series of calculated trades, he artificially suppressed asset prices, enabling him to withdraw funds at highly favorable rates. Medjedovic’s actions polarized the DeFi community. A Twitter account linked to him, under the alias [**ZetaZeroes**](https://x.com/ZetaZeroes), defended the exploit, arguing that the protocol had simply been "out-traded." [In a 2022 interview with *Bloomberg Businessweek*](https://www.bloomberg.com/news/features/2022-05-19/crypto-platform-hack-rocks-blockchain-community?embedded-checkout=true), he described his approach as leveraging "mispricing opportunities," reinforcing the controversial belief that in decentralized finance, **"code is law."** However, legal experts, including Indexed Finance co-founder Dillon Kellar, dismissed this argument, emphasizing that DeFi operates within broader financial regulations and cannot function as a lawless ecosystem. Following the Indexed Finance hack, Medjedovic remained under scrutiny. In November 2023, he allegedly exploited KyberSwap for $48.8 million by manipulating liquidity pools through smart contract vulnerabilities, demonstrating an increasing level of sophistication in financial exploits. His repeated targeting of DeFi protocols raised urgent concerns over security loopholes, ethical boundaries, and the need for greater regulatory oversight. ## **The DOJ Indictment and Criminal Charges** On February 3, 2025, [the U.S. Department of Justice (DOJ) unsealed a five-count indictment](https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes) in the Eastern District of New York against Andean Medjedovic, charging him with: * **Wire Fraud** – Fraudulently acquiring digital assets through manipulative trading strategies. * **Unauthorized Damage to a Protected Computer** – Exploiting Vulnerabilities in Indexed Finance and KyberSwap’s Smart Contracts. * **Attempted Hobbs Act Extortion** – Demanding control over KyberSwap in exchange for returning 50% of stolen assets. * **Money Laundering** – Concealing illicit funds through blockchain bridges, cryptocurrency mixers, and swap transactions. * **Conspiracy** – Collaborating with undisclosed parties to execute and launder the stolen funds. [Prosecutors allege that Medjedovic leveraged flash loans](https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi) to borrow millions in digital tokens, using smart contract exploits to miscalculate asset values and withdraw investor funds at artificial prices. His KyberSwap attack in 2023 reportedly netted him $48.8 million, further strengthening his reputation as one of DeFi’s most sophisticated exploiters. If convicted, Medjovic faces up to 10 years for unauthorized damage to a protected computer and 20 years on each of the other four charges. His sentencing will ultimately be determined by a federal district court judge under U.S. Sentencing Guidelines. ### **Ongoing Lawsuit in Canada** In parallel to the U.S. criminal proceedings, a class-action lawsuit remains active in Canada. Filed in the [**Ontario Superior Court of Justice** by **Cicada 137 LLC**](https://www.canlii.org/en/on/onsc/doc/2021/2021onsc369/2021onsc369.html), representing Indexed Finance investors, the suit challenges Medjedovic’s "code is law" defense. Indexed Finance contributor[ Laurence Day](https://x.com/functi0nZer0) has argued that legitimizing such actions would set a dangerous precedent, incentivizing exploiters rather than holding them accountable within legal frameworks. As of now, Medjedovic remains a fugitive, actively pursued by international law enforcement agencies, including the FBI, IRS-CI, and Homeland Security Investigations (HSI)**.** His case underscores the urgency of addressing security flaws in DeFi while establishing clear legal boundaries for financial exploits. ## **Blockscope’s Investigation** As part of our ongoing commitment to tracking crypto exploits, [**Blockscope**](https://www.blockscope.co/) conducted an in-depth investigation into the **Indexed Finance (2021) and KyberSwap (2023) hacks.** Our analysis uncovered: * **A common pattern** **in Medjovic’s tactics** between the Indexed Finance and KyberSwap hacks. * **Sophisticated laundering techniques**, including the use of blockchain bridges, mixers, and fake exchange accounts. * [**A failed attempt to bribe** ](https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi)an undercover law enforcement officer with $80,000 to unfreeze stolen funds. Our findings underscore the sophistication of both exploits. To illustrate this, the next section provides a comprehensive technical breakdown of the 2021 Indexed Finance hack. # The Indexed Finance Hack ## Summary [Indexed Finance](https://x.com/ndxfi?lang=en) was a decentralized finance (DeFi) protocol built on Ethereum, designed to function like traditional mutual funds or exchange-traded funds (ETFs). Instead of holding a basket of equities, its index pools contained a mix of digital assets, offering users single-token exposure to diversified crypto portfolios. Its smart contracts were built largely from scratch, providing automated portfolio management while also introducing unique vulnerabilities. On October 14, 2021, the protocol suffered a catastrophic exploit resulting in a $16 million loss of user funds. The attacker, 19-year-old math prodigy [Andean Medjedovic, exploited a flaw in the re-indexing mechanism](https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi), manipulating smart contract logic to extract multimillion-dollar gains from investor funds. In a groundbreaking move, Indexed Finance pursued legal action against him—one of the first times a DeFi hack was challenged in traditional courts. [A class-action lawsuit was filed, and after Medjedovic claimed that "code is law"](https://www.canadianlawyermag.com/practice-areas/litigation/code-is-law-defence-to-be-tested-in-case-of-allegedly-stolen-crypto/365022) and enlisted top crypto lawyers, a Canadian judge issued an arrest warrant in December 2021 when he failed to appear in court. Despite these legal efforts, the stolen funds remain unrecovered. ### Key Addresses and Transcations **Index Pool:** 0x5bd628141c62a901e0a83e630ce5fafa95bbdee4 **Controller**: 0x120c6956d292b800a835cb935c9dd326bdb4e011 **DEFI5 Pool:** 0xfa6de2697d59e88ed7fc4dfe5a33dac43565ea41 **CC10 Pool:** 0x17ac188e09a7890a1844e5e65471fe8b0ccfadf3 **Exploiter Contract 1**: 0x277e851587eb5da22b52a10f4788576e68150277 **Exploiter Contract 2:** 0xfbc2e6b188013fc5eacd9944e6b8ced2c467464a **Exploiter:** 0xba5ed1488be60ba2facc6b66c6d6f0befba22ebe **Defi 5 Tx:** 0x44aad3b853866468161735496a5d9cc961ce5aa872924c5d78673076b1cd95aa **CC10 Tx:** 0xbde4521c5ac08d0033019993b0e7e1d29b1457e80e7743d318a3c27649ca4417 ## Decoding the Exploit The exploit stemmed from a flaw in the re-indexing mechanism of the Controller contract, which allowed Medjedovic to manipulate price calculations in the DEFI5 and CC10 liquidity pools. He artificially distorted token valuations by leveraging $156 million in flash loans from [Uniswap](https://app.uniswap.org/) and [Sushiswap](https://www.sushi.com/ethereum/swap), enabling withdrawals at manipulated exchange rates. The attack, spanning an entire Ethereum block with over 1,000 recorded events, is among the most sophisticated DeFi exploits ever executed. Indexed Finance relied on a single reference token (UNI) to estimate total pool value, using Uniswap oracles and the `extrapolatePoolValueFromToken` function to price new tokens. When market fluctuations caused discrepancies, the `updateMinimumBalance` function adjusted virtual balances to prevent rebalancing delays.

Understanding Reindex Pool function using AI feature of Blockscope's **Contract Analysis** tool

Medjedovic exploited this system by triggering a re-index, making UNI the reference token, and using flash loans to acquire nearly all the UNI in the pools. With valuation based solely on the diminished UNI balance, the system miscalculated pool worth—DEFI5, for example, was valued at only \~$300K despite holding over $100M in assets. This error allowed him to mint DEFI5 tokens at an undervalued rate and redeem them for real assets like AAVE, COMP, MKR, SNX, and CRV, draining millions before repaying the flash loans and netting $11M. ## On-Chain Activity On-chain analysis using the Tracer tool mapped the flow of funds and transaction interactions across all involved addresses. This visualization detailed flash loan transactions, fraudulent profit extraction, and asset movements, exposing the key participants and the intricate transaction patterns that enabled the exploit.

Tracer showing the Indexed Finance exploit

To understand the exploit better, let's study the DEFI5 Pool exploit and see how the exploiter manipulated the contract and made fraudulent gains. ### Breakdown and Analysis #### **1. Initiating the Re-Indexing Process** At the time of the attack, the DEFI5 index pool was scheduled for a re-indexing event following three weekly re-weighs, which allowed any participant to trigger a re-index. Medjedovic invoked the `reindexPool` function to add SUSHI to the index, joining UNI, AAVE, COMP, SNX, CRV, and MKR. Since UNI was the first token in the list, its price was used to approximate the pool’s total value. This process also established a minimum balance for SUSHI, initially set at 11,926 SUSHI (\~$126k). Tx. Hash: 0x44aad3b853866468161735496a5d9cc961ce5aa872924c5d78673076b1cd95aa

Transaction Decoder displaying the trace call of the DEFI 5 Pool during re-indexing

Logs from Transaction Decoder showing Sushi Token added after re-indexing

**2. Borrowing and Lending Tokens** The exploit contract 0x277e851587eb5da22b52a10f4788576e68150277 secured a flash loan of approximately $156 million in tokens—including UNI, AAVE, COMP, SNX, CRV, and MKR—from SushiSwap and Uniswap V2. These borrowed assets were used strategically to manipulate the pool’s valuation.

Trace call revealing flash loans taken by the exploiter

Multimillion worth of assets incoming through flash loans

*** **3. Draining UNI to Distort the Pool Value** Medjedovic repeatedly swapped UNI—subject to `MAX_IN_RATIO` constraints—across multiple transactions. This significantly depleted the UNI balance in the pool, leading to a gross underestimation of its total value. To compound the effect, he also lent the borrowed tokens via SushiSwap to increase his leverage.

Token transfers indicate UNI being swapped for AAVE to drain UNI’s balance from the pool

**4. Manipulating Minimum SUSHI Balance** With the UNI balance artificially diminished, Medjedovic invoked the `updateMinimumBalance` function. Since the Controller relied on the UNI balance for pricing, the recalculated pool value plunged—DEFI5 was mispriced at only 29,851 SUSHI (\~$300k) despite containing over $100M in assets. Exploiting this discrepancy, he minted DEFI5 tokens using the undervalued UNI in multiple transactions, which inflated the pool supply dramatically. Tx. Hash: 0x44aad3b853866468161735496a5d9cc961ce5aa872924c5d78673076b1cd95aa

Exploiter minting DEFI5 tokens using cheaply acquired UNI

Next, he borrowed SUSHI to mint additional DEFI5 tokens at the inflated valuation and burned them in cycles to extract the underlying assets.

**6. Extracting Liquidity and Paying Flash Loans** Using the `joinswapExternAmountIn` function, he exploited the manipulated SUSHI weight to acquire large amounts of LP tokens. He then used `exitPool` to convert these tokens back into underlying assets, systematically draining UNI, AAVE, COMP, SNX, CRV, MKR, and SUSHI. By repeating this cycle, he extracted liquidity, repaid the flash loans, and exited with approximately $11 million in assets.

Trace call shows the exploiter exiting the pool by withdrawing funds

Exploiter profited $11M+ by artificially inflating rewards

A similar tactic was applied to the CC10 Pool, yielding additional profits. Tx. hash: 0xbde4521c5ac08d0033019993b0e7e1d29b1457e80e7743d318a3c27649ca4417

Exploiter 2 contract transferring profits from the CC10 Pool to the main exploiter

## Post Exploit On-chain forensics provided a breakthrough in identifying the attacker. Indexed Finance Owners Dillon and Laurence noticed suspicious activity from a Discord user named "UmbralUpsilon," who later changed his username to "BogHolder#1688" and deleted messages. Further investigation revealed that BogHolder#1688 had won 4th place in a coding competition, with the prize money sent to an Ethereum address linked to Tornado Cash—this address matched withdrawals from the exploiter’s wallet. Blockchain analysis then connected these activities to a GitHub account ("mtheorylord1") tied to Medjedovic’s email, conclusively unmasking him as the attacker. Indexed Finance even offered him 10% of the stolen assets, which he refused and taunted Dillion and Laurence instead. Moreover, a legal case is still underway against Medjedovic in Ontario, Canada, and an indictment has been read against him in a district court of Brooklyn, NY, marking a significant effort to hold a DeFi hacker accountable through traditional legal channels. In a recent tweet, [Laurence shared an old email, which he sent to Medjedovic back in 2021.](https://x.com/functi0nZer0/status/1886483774071828721)

Post Mortem Report of the exploit by Indexed Finance: # The Second Allegation ## Kyberswap Hack

In the indictment, Medjedovic was alleged to have exploited [KyberSwap](https://kyberswap.com/swap/ethereum) in 2023, as well as Indexed Finance in 2021, manipulating central liquidity pools using front-running bots and a network of dozens of addresses. By executing sophisticated MEV (Maximal Extractable Value) attacks, Medjedovic drained approximately $48.8 million from KyberSwap’s liquidity pools. A Tracer analysis reveals the intricate nature of this exploit, showing how Medjedovic leveraged automated trading bots to front-run legitimate transactions. By predicting the order flow, he destabilized KyberSwap’s liquidity structure, profiting from arbitrage inefficiencies and price slippages. The attack resulted in massive losses for liquidity providers and highlighted vulnerabilities in automated market maker (AMM) designs.

A basic tracer for the KyberSwap exploit showing the exploiter leveraging multiple protocols, including Tornado Cash and bots, to execute and obfuscate funds.

KyberSwap, a decentralized exchange (DEX) powered by the Kyber Network, facilitates seamless token swaps using aggregated liquidity pools. The exploit targeted centralized liquidity pools, where Medjedovic's bot-driven transactions manipulated price curves, allowing him to execute trades at unfair advantages. The attack was executed using **flash loans**, rapidly borrowing and repaying assets within the same transaction to amplify the exploit’s impact. In the aftermath of the attack, **Kyber Network engaged with Medjedovic**, urging the return of stolen funds. However, responses remained elusive, and negotiations ultimately failed.

On-chain message from the hacker to the KyberSwap team; Tx hash: 0x7a8912583520304ce2364fa165dafe94461a91ab2dcf45dab942e296594dc40a

Kyberswap's proposal to the hacker; Tx. hash: 0xfeb8bd91320ed818cefd72aba25d48f4b50964549681096d6fae3d2320c75743

A more detailed technical breakdown can be found in the **KyberSwap Post-Mortem Report:** [**https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/**](https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/) ## Conclusion The case of Andean Medjedovic marks a pivotal moment in decentralized finance (DeFi), highlighting the growing legal scrutiny of DeFi exploits. His attacks on Indexed Finance (2021) and KyberSwap (2023) exposed critical vulnerabilities in smart contracts and governance, siphoning nearly $65 million through flash loan attacks, price oracle distortions, and MEV strategies. His indictment by the U.S. Department of Justice (DOJ) and an ongoing class-action lawsuit in Canada challenge the "code is law" defense, setting a precedent that DeFi exploits can be prosecuted as financial crimes rather than technical arbitrage. Beyond legal ramifications, Medjedovic’s case underscores the urgent need for stronger DeFi security measures, including rigorous audits, improved oracle mechanisms, and real-time threat detection. As he remains a fugitive, pursued by global law enforcement, the outcome of these proceedings will shape the future of DeFi accountability, influencing regulations, investor confidence, and the industry's long-term sustainability. The balance between decentralization and legal responsibility is now more crucial than ever. For more information regarding the indictment and the legal charges, refer to this link: **Written by**: [Tushar Tiwari](https://in.linkedin.com/in/tushar-tiwari-1380271b7), Analyst @ Blockscope For more information, please reach out to us at ****

## MrBeast's Alleged Cryptocurrency Involvement: An Investigative Overview Jimmy Donaldson, widely known as MrBeast, the world's most-followed YouTuber with over 330 million subscribers and a net worth exceeding $500 million, is facing serious allegations of involvement in controversial cryptocurrency activities. [According to an investigation published by on-chain analyst SomaXBT on October 11, 2024, MrBeast allegedly earned over $10+ million (Which Blockscope's research team found more than $20M) by promoting small-cap tokens such as SUPER, PMON, and SHOPX during their initial offerings in 2021.](https://x.com/somaxbt/status/1844718118129603069) The allegations suggest a potential pattern of early investments, aggressive influencer-driven hype, and strategic sell-offs, raising concerns about the ethical use of social media influence in cryptocurrency. Analysts, including [SomaXBT](https://x.com/somaxbt?lang=en) and [KasperLoock](https://x.com/kasperloock), identified over 50 wallets allegedly linked to MrBeast, suggesting an intricate network used to cover up insider trading and "pump-and-dump" tactics. One key wallet attributed to MrBeast, ***0x9e67D018488aD636B538e4158E9e7577F2ECac12***, served as a focal point in these transactions. The investigation emphasizes the potential risks associated with influencer-led promotions in crypto. It underlines how high-profile figures might knowingly or unknowingly exploit their reach to drive financial gain at the expense of unsuspecting investors. ## Tracing MrBeast's Hive of Wallets Our investigation reveals a fascinating but overwhelming network of wallets allegedly linked to MrBeast, which we’ve mapped using **Blockscope Tracer**. Dubbed the "Beast Hive," this network illustrates how influencers may orchestrate their transactions to maximize profits while avoiding detection. There were a lot of tokens involved like ETH, USDT, GUSD, PEPE, USDC, AAVE, and many more including NFTs. Tokens like ERN, BOSON, SUPER, etc which were bought in pre-sale were cycled through multiple wallets before being sold, effectively obfuscating the trading patterns. Wallets in the Beast Hive often interact with each other in clusters, making it easier to distribute tokens and profits while creating a complex web of transactions. Below is a screenshot of the 'Beast hive' where we found multiple wallets associated with MrBeast and can see some of them cashing out at various exchanges.

Hive of MrBeast: Exchanges, addresses associated, funded and created by MrBeast

To further simplify and clarify the intricate network of wallets associated with MrBeast, we utilized **Cohort analysis**. This tool allowed us to isolate these cohorts so we can identify clusters of wallets that are most likely linked to MrBeast and track their shared activities.

Cohort Analysis: Showing wallets funded by and linked to MrBeast

## Participation in Cryptocurrency Projects As part of our investigation, we identified several cryptocurrency projects where MrBeast allegedly engaged in questionable trading activities. These projects, which include both tokens and NFTs, often involved strategic participation during pre-sales or initial offerings, followed by coordinated promotional efforts that inflated their market value. The subsequent sell-offs traced to wallets linked to MrBeast have raised concerns about insider trading and market manipulation. Such practices undermine the integrity of the cryptocurrency market and place retail investors at risk of financial loss. | PROJECT | PROFIT EARNED (Approx.) | TIMELINE | | ------------------------ | ----------------------- | ------------ | | SuperVerse | $11M | FEB-OCT 2023 | | ERN (Ethernity Chain) | $4.6M | MAR-OCT 2021 | | AIOZ | $1M | APR-MAY 2021 | | Refinable | $200K | APR-MAY 2021 | | ShopX | $484K | MAR-NOV 2021 | | JIGSTACK (STAK) | $1.3M | MAY-JUL 2021 | | XCAD | $285K | MAY-JUN 2021 | | Polychain Monster (PMON) | $1.7M | MAR-MAY 2021 | | Boson Protocol (BOSON) | $615K | APR-JUL 2021 | | Standard Protocol (STND) | $130K | APR-MAY 2021 | | ALLY Direct (DRCT) | $200K | JUL-OCT 2021 | | Terona (CAPS) | $680k | 2021-24 | | Metis L2 | $660 | 2021-23 | Source: [SomaXBT](https://x.com/somaxbt?lang=en), [KasperLoock](https://x.com/kasperloock), [Angelfacepeanut](https://x.com/angelfacepeanut), [Loock.io, ](https://x.com/loockadvising)and various other on-chain sleuths In the following sections, we delve deeper into some specific projects, analyzing trading patterns, timelines, and financial outcomes attributed to wallets allegedly linked to MrBeast. # SuperToken Case Study ## SuperVerse (Formerly called SuperFarm) [SuperVerse](https://superverse.co/) previously known as SuperFarm, launched with ambitious promises of a thriving NFT marketplace, gaming integrations, and flagship games. Despite its high-profile marketing, which featured prominent influencers such as [EllioTrades](https://x.com/elliotrades), [MrBeast](https://x.com/MrBeast), and [KSI](https://x.com/KSI), on-chain investigations revealed significant discrepancies between its projected goals and actual outcomes. Notably, public investors faced unexpected refunds after the token's 50x surge during its launch, raising concerns about transparency and fairness. Shifting to the core evidence, key tweets and leaked communications with [Elliotrades](https://x.com/elliotrades) on live stream reveal MrBeast's involvement and $ SUPER investment of 100 K.

Screenshot from elliotrades' live stream revealed MrBeast’s $100k $SUPER investment.

Mr. Beast showed his support following the SuperFarmDAO on X

MrBeast used his brand and influence to push Super, tweeting about Super from his Twitter/X account

**On-chain activity** traced via Blockscope uncovers the flow of funds and how MrBeast made this SuperVerse, his biggest crypto fortune. MrBeast received a total of 10M $SUPER, an initial allotment of 1M, and several allotments of tokens over a few months. This main wallet, *0x9e67d018488ad636b538e4158e9e7577f2ecac12*, tunneled the funds into three wallets, finally swapping all the tokens and making approximately $7.5M approx in profits over a mere investment of $100K. The tracers below visualize everything in a pretty comprehensive manner, how MrBeast is alloted $SUPER by two different addresses, once a million $SUPER and then a total of 9M gradually over a while, which he directed to his various side wallets and swapped $SUPER for $ETH and made millions.

We can see below that Uniswap was being used to swap funds, and MrBeast's wallet can be seen getting around 3,813 $ETH from the DEX.

### Breakdown and Timeline • On **Feb 22nd, 2021**, MrBeast received the initial supply of 1M $SUPER in his main wallet.

• On **March 30th, 2021** MrBeast sends his 1M $SUPER to his side wallet *0x4f7b657a2cae7a8808df1d889838d5da33007ae8*. Tx hash: *0xfeb3cd551596301f5a015fa4ac94f72611ed8a914c75f34b15aa72c8e3136303*

MrBeast transferred 1M $SUPER to 0x4f7b...

• Then, MrBeast's wallet received $SUPER several times from the Vesting Allotment wallet until October 2021, which MrBeast redirected to *0x4f7b...* from **May to July 2021.**

• Throughout **March till June 2021**, *0x4f7b..* swapped all the $SUPER incrementally into $ETH, just making around $6.2M out of it.

• After making a good fortune, *0x4f7b..* sent 360K $SUPER back to MrBeast wallet. Although it went silent for some period, it kept on getting supplies from the Vasting Allotment address. Finally, on **August 16th, 2021** MrBeast transferred 3.5M $SUPER to his address labelled as "*Bobbie Digital" 0x2c071af9dcefb7155659b662480cbb8679977394*

• On **August 17th, 2021** Bobbie Digital wallet sent 1.5M $SUPER to side wallet *0xed3f5d401a270416e5008ce35e07eb0721d6f8b4*. Tx Hash: *0xd5d0d7a772e31da58174a4695760063766525c10e90439a0a8389b2427626ca5*

• In **August and September 2021** *0xed3f..* sold most of the $SUPER and sent 335K supply to MrBeast wallet, profiting around $1.1M.

• Finally, Bobby Digital wallet sells off all supply of $SUPER on **October 6th, 2021 using** Metamask wallet *0x74de5d4fcbf63e00296fd95d33236b9794016631*, generating $1.2M.

Also, using our wallet profiler, it can be proved that the various wallets linked to MrBeast, were funded by him.

MrBeast's total profits from $SUPER transactions are estimated at **$11M**, derived from the initial $100K investment. The SuperVerse-related activity continued sporadically until 2023, with additional purchases of $SUPER worth approximately $25K. # Ethernity Chain ## Ethernity Chain (ERN) [Ethernity Chain](https://www.ethernity.io/) launched in 2021 as a secure platform for authenticating and trading NFTs. Built on Ethereum, it provided a trusted marketplace for digital collectibles and has since transitioned to a Layer 2 solution to enhance scalability. With AI integration, Ethernity aims to streamline operations in the entertainment sector. However, the project’s promotional strategy and token allocation raise concerns. Influencers like MrBeast actively promoted Ethernity Chain through tweets, his presence on ERN's website, and participation in Twitter Spaces. [KoroushAK](https://x.com/koroushak?lang=en) and [CryptoRand](https://x.com/crypto_rand?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) also played key roles in promoting Ethernity Chain, with on-chain activity revealing significant token dumps and profit-making undermining the narrative of long-term commitment to the project.

**On-chain investigation** revealed these allegations to be somewhat true as we dug deep into the burrow, and Blockscope's Tracer helped us map out MrBeast's ERN saga. MrBeast received $ERN tokens from the presale and additional allocations, which he accumulated and transferred to his side wallets *0x9b006708af63a779d8146ca91a2ae2d34cf0b830* and *0x2eb7d3c6b31b70a480d4af1bd8cd05c1b10d38d6*, subsequently selling them for substantial profits.

### Breakdown and Timeline • On **March 8th, 2021** MrBeast wallet *0x9e67d018488ad636b538e4158e9e7577f2ecac12* received 72.7K $ERN from the pre-sale. Tx. Hash: *0x056c951764832173f40437df83162d4f461feb218b337ae9dcd2c8ef5670cbbe*

• On **May 3rd, 2021** MrBeast wallet transfers 35K $ERN to side wallet *0x2eb7d3c6b31b70a480d4af1bd8cd05c1b10d38d6*. Tx Hash: *0x695af62963c0ce98de212097263e17640edbea7ce30ad3ed75cf7defaa3a79d9*. By **May 4th, 2021** the side wallet *0x2eb7...* emptied the wallet within the same day in multiple transactions, netting around $850K in profits.

• On **May 4th, 2021** MrBeast transferred 43.4K $ERN to the side wallet *0x9b006708af63a779d8146ca91a2ae2d34cf0b830*. Tx Hash: *0x6e40aaaa326ecfe2edc12d1719f57b5dfce76936d516c1a9b041df38483f037f*. And similar to 0x2eb7, it sold all the supplies from **May 4th to May 13th**, profiting around $1M.

0x9b00 sold all the supply till May 13th

• On **October 29th, 2021**, MrBeast's wallet received 181.8K $ERN, which he sold all the supplies on **November 30th**, nearly making $3M in profits.

• Parallelly, in **May 2021** MrBeast's main wallet got 54.5K $ERN, which he transferred to his side wallet *0x5ba15F9208C98a1c263A3D18EC6ca93778d1547e* on **October 18th, 2024,** which he is still holding.

The Ethernity Chain investigation reveals that MrBeast’s on-chain activities resulted in profits exceeding **$4.6M**. While his wallet still holds some $ERN tokens in 2024, the pattern of significant sales raises questions about long-term intentions versus short-term gains. # Other Protocols and Insider Trading Allegations ## Other Protocols Similar to SuperVerse and Ethernity Chain, MrBeast extended his investments to projects like [**AIOZ**](https://aioz.network/) and [**Refinable**](https://x.com/refinableapp?lang=en), leveraging his massive social media presence and questionable practices. These ventures reportedly generated around **$1.2M** in profits.

MrBeast following refinable (Made around $200k in profit)

## Insider Trading Allegations Beyond presale investments and pump-and-dump schemes, MrBeast has been implicated in alleged insider trading activities, with connections to notable figures like [**KSI**](https://x.com/KSI), [**GaryVee**](https://x.com/garyvee), and[ **LazarBeam**](https://x.com/Lazarbeam). Projects including [**SHOPX**](https://x.com/shopxlabs?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor), [**XCAD**](https://x.com/XcademyOfficial), [**JIGSTACK**](https://x.com/jigstack), [**Polychain Monsters**](https://x.com/protocolmon), [**Boson Protocol**](https://x.com/BosonProtocol), and [**Standard Protocol** ](https://x.com/standardweb3)reveal a recurring pattern of substantial profits—unlikely for a content creator without insider information. ## SHOPX [SHOPX](https://x.com/shopxlabs?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor) is a RWA-based project that tokenizes products to reward their customers. In the past, it has been seen that this project has been pushed by a lot of people like [TheCryptoLark](https://x.com/TheCryptoLark), [CryptoBanter](https://x.com/crypto_banter), etc. [ZackXBT](https://x.com/zachxbt) already analyzed this back in 2022 and somehow warned the people about these influencers using their presence for immoral things, which later turned out to be right.

Tweet2 where Lark is selling all the $SHOPX

But how do these things prove the connection of MrBeast with SHOPX? See below!

SHOPX tweet about MrBeast following them

On-chain activity reveals that MrBeast was also allocated $SHOPX in the pre-sale along with other influencers like Lark and KSI. [It has been analyzed by SomaXBT too which he tweeted on his X.](https://x.com/somaxbt/status/1844718089478324309) The below tracer shows MrBeast wallet *0x9e67...* received 607K $SHOPX on **March 31st, 2021.**

On receiving the token allocation, on **April 9th, 2021**, he sent his supply to the side wallet *0x7c1b16F59B1aB069D33CA93aB6CaF2D218A1b6D6.* Tx Hash: *0x35bbb4e3b71fe9248d5636f6c167d34aa57a5db9a123b7f6108d85ec791cc189*

Gradually, the side wallet sold all the supply within a short period and sent the rest of the remaining supply back to the MrBeast wallet.

Selling $SHOPX and returning rest of the tokens to MrBeast

MrBeast sold the rest of the supply too by the end of 2021 and he made a total **profit of more than $480k.** ## Polychain Monsters (PMON) [Polychain Monsters ( Now Protocol Monsters)](https://x.com/protocolmon) was a project used to create digital collectible monsters on the blockchain. [ZackXBT did a thorough analysis and wrote an article on this, mentioning the shady people involved in this and how it was meant to benefit the few.](https://x.com/zachxbt/status/1410356539668447233) Also like the earlier project, there was a lot of promotion involved in pumping this project too, and this time it was KSI. Allegations have been made that MrBeast's investment in $PMON was out of KSI's promotional deal and insider information.

Onchain activity clearly shows that MrBeast wallet received 25K and 68.75K $PMON, which he transferred to his side wallet *0x4f7B657a2cAe7A8808Df1D889838d5Da33007ae8.*

MrBeast swapped $PMON and received $ETH using Uniswap

sent to 0x4f7b, which sent 3,813 $ETH to his main wallet 0x9e67d. In most of the protocols analyzed, MrBeast frequently relied on Uniswap to swap various tokens. The tracer above shows that the funds were swapped using Uniswap V2 and were sent to 0x4f7b... which sent 3,813 $ETH to his main wallet 0x9e67d...

The address 0x4f7b... has conducted 972 transactions and has received tokens in over 1,000 transactions.

The side wallet 0x4f7b... sold the $PMON in several hundred transactions, finally **profiting around $1.7M.**

## **Recurring Trends: Pump-and-Dump Allegations** All the aforementioned projects mentioned are tied to MrBeast, such as **Standard Protocol ($STND)** **SHOPX**, **XCAD**, **JIGSTACK**, **Polychain Monsters, and** **Boson Protocol,** exhibit similar trajectories: * **$STND:** Down **99.5%** from its peak. * **$SHOPX:** Down **99.85%** from its peak. * **$PMON:** Down more than **99%** from its peak These patterns suggest a deliberate strategy to inflate token prices through influencer-driven hype, followed by large-scale liquidation, leaving retail investors at a loss. While MrBeast’s ventures into blockchain projects like SHOPX and Polychain Monsters may have yielded millions in profits, the stark decline in token valuations and recurring patterns of token liquidation raise questions about ethical practices among people with high influence. Allegations of insider trading, paired with the exploitation of social influence, create a compelling case for deeper scrutiny of these activities. ``` ``` # Conclusion Our investigations uncovered a pattern of wallet tunneling, fund swapping, and cash-outs through multiple addresses. Notably, MrBeast relied heavily on exchanges like **Gemini** and **Binance** to cash out into fiat currencies.

If we see the interaction of MrBeast's main wallet with the Gemini Deposit address *0xd6210f2dc5323f4a1b4b766a0e732d6dfa26935b*, it is more than $8.6M in GUSD and ETH at today's price, followed by Bobby Digital with around $3M.

Bobby Digital and Gemini Deposit intercation

## **The Final Word** From SuperVerse to Polychain Monsters, every project analyzed revealed MrBeast’s involvement—sometimes as an investor, other times as a promoter. While his actions skirt the boundary of legality, they undeniably reside in a gray area of ethics and morality, especially for someone with such a vast, impressionable audience. Despite holding significant portions of the tokens mentioned earlier, his methods and involvement remain shrouded in ambiguity. What’s clear is this: **MrBeast profited millions, but not everything about these transactions feels entirely transparent or ethical.** **Investigation by:** [**Tushar Tiwari**](https://research.blockscope.co/mrbeast-investigation/www.linkedin.com/in/tushartiwari21)**, Analyst @ Blockscope** For more information, please reach out to us at ****

**Disclaimer: Best Effort Investigation** This investigation and its findings represent our best effort based on the information available at the time. However, please be aware of the following limitations: * The data used in this investigation may contain inaccuracies, omissions, or errors. * Information sources may be incomplete or subject to change. * New evidence may emerge that could alter the conclusions. * Analysis and interpretations are based on current understanding and may evolve. We have made every reasonable attempt to ensure accuracy, but cannot guarantee that all information is entirely correct or complete. This report should be considered a snapshot of our current knowledge and understanding, subject to revision as new information becomes available. # Investigate Flash Loan Txn #### Summary Flash Loan Transactions are a very common form of exploit that occur on the blockchain. Here we will investigate an actual on-chain incident where funds were stolen and moved to a rogue wallet. #### Blockscope Tools we will use | Action | Tool Used | | ----------------------------------------------------------- | ------------------------------ | | Decode the initial Transaction | Blockscope Transaction Decoder | | Trace the stolen funds | Blockscope Token Tracer | | Check Wallet for balance | Blockscope Wallet Profiler | | Find Associated Wallets | Blockscope Wallet Profiler | | Set up real-time monitoring wallet holding the stolen funds | Blockscope Watchtower | #### Customers Types The following customer types would be interested in conducting on-chain investigations similar to the one we are about to conduct. * Institutions * Government Agencies * Regulators * Forensics Teams #### Investigation 1\) Investigation Entry point, search blockchain transaction

2\) We can see, blockscope was able to decode most of the on-chain data

3\) Let's look at the top addresses, protocols and tokens involved in this transaction

4\) First red flag that goes off, seeing the Self Destruct function.

5\) We can see all the known(green) accounts and unknown(red/orange) accounts. This high level view tells us what protocols and tokens were used

6\) Filtering out the interactions to just show us transfers of ERC-20 and Native tokens lets us trace the stolen funds to 1 particular account. We can now focus on tracing the funds in and out of that account using the Tracer Tool

7\) We can see the 65 eth that moved into this account and its subsequent movement to Kyberswap and another contract

8\) Further analysis lets us see that this user is a repeat exploiter and has exploited and gained 962 ETH in the past, worth over 2M USD today

9\) Using Wallet Profiler, we check the wallet’s holdings and see it still had the 2M worth of Ether

10\) Looking at the very first transaction, the user supplied funds here via an account that used tornado cash on Feb 14, 2020. This was prob an attempt at keeping their identity hidden by using funds that went through tornado cash.

11\) With a few clicks we’ve set up monitoring using Blockscope's Watchtower tool

12\) We will be notified in real-time for any new activity from this wallet.

# Blockscope Explore Blockscope's Investigations, Research, and Articles — all in one place.

## What is Blockscope? **Blockscope** is a Web3 data intelligence platform designed for blockchain professionals, institutions, and law enforcement agencies. It offers intuitive, easy-to-use tools that support a wide range of use cases — from real-time on-chain monitoring and crypto forensics to data indexing, cross-chain investigations, and DApp development. Whether you're tracing illicit activity, analyzing wallet behavior, building on-chain analytics, or streamlining compliance workflows, Blockscope delivers the infrastructure and actionable insights you need to operate with confidence and precision in the Web3 ecosystem. ## 🔍 **Investigations** #### **• November 2025 –** [Inside the Balancer Exploit: A Comprehensive Forensic Review](https://research.blockscope.co/balancer-exploit) #### • September 2025 – [UXLink Exploit Analysis](https://research.blockscope.co/untitled-1) #### • August 2025 – [Coinbase Approval Exploit](https://research.blockscope.co/coinbase-approval-exploit) #### • July 2025 – [CoinDCX Breach: Unmasking the Multichain Heist](https://research.blockscope.co/coindcx-breach) #### • June 2025 – [ResupplyFi Exploit: From 1Wei to $ 10M](https://research.blockscope.co/resupplyfi-exploit) #### • May 2025 – [Cetus Protocol Exploit Analysis](https://research.blockscope.co/cetus-protocol-exploit-analysis) #### • April 2025 – [KiloEx Exploit Analysis: From Breach to Recovery](https://research.blockscope.co/kiloex-exploit-analysis) #### • March 2025 – [SIR Protocol Exploit: Analyzing the Transient Storage Vulnerability](https://research.blockscope.co/sir-protocol-exploit) #### • March 2025 – [Zoth Vault Breach: Admin Key Exploit Analysis](https://research.blockscope.co/zoth-vault-breach) #### • February 2025 – [Bybit Breach Uncover: Tracing a $1.5 Billion Crypto Heist](https://research.blockscope.co/bybit-breach) #### • January 2025 – [The Phemex Heist: $85M Vanished Across 16 Chains](https://research.blockscope.co/the-phemex-heist-multichain-innovation-or-securit) #### • January 2025 – [Moby Trade Exploit and Swift Seal911 Response](https://research.blockscope.co/moby-trade-and-the-breached-private-key) #### • November 2024 – [MrBeast Investigation](https://research.blockscope.co/mrbeast-investigation) #### • September 2024 – [The Penpie Heist](https://research.blockscope.co/penpie) #### • August 2024 – [Crypto Whale Sinks: $55.4M Phished Away from MakerDAO Vault](https://research.blockscope.co/crypto-whale-sinks-usd55.47m-phished-away) #### • August 2024 – [Convergence Finance 200K Exploit](https://research.blockscope.co/convergence-finance-200k-hack) #### • July 2024 – [WazirX $235M Exploit](https://research.blockscope.co/blockscope-wazirx-235m-exploit-investigation) #### • September 2023 – [HTX(Houbi) Exchange Hack Breakdown](https://research.blockscope.co/htx-houbi-exchange-hack) ## 📄 **Reports** #### • [Mid-Year 2025 Crypto Crime Report](https://research.blockscope.co/mid-year-2025-crypto-crime-report) #### • [2024 Crypto Crime and Security](https://medium.com/@blockscope.co/2024-crypto-crime-and-security-44a368501b5d) ## 📝 **Articles** #### **•** [Beyond the Candle: The Crypto Apocalypse of October 10](https://research.blockscope.co/the-october-crash) #### **•** [Supply Chain Attacks: A Growing Concern for Crypto](https://research.blockscope.co/supply-chain-attacks) #### **•** [RCMP Busted TradeOgre: Canada’s Biggest Crypto Enforcement Yet](https://research.blockscope.co/rcmp-busted-tradeogre) #### **•** [**Billions at Risk, Pennies Stolen: Inside the npm Phish that Shook the Web**](https://research.blockscope.co/npm-hack) #### • [The $14.5B LuBian Hacker: How the Crypto World’s Biggest Theft Stayed Hidden for 5 Years](https://research.blockscope.co/august-2025-lubian-hack/) #### • [Iranian Exchange Nobitex Suffers $90 Million Loss in Coordinated Crypto Hack](https://research.blockscope.co/notibex-hack) #### • [Tracing Cross-Chain Asset Movements with Blockscope](https://medium.com/@blockscope.co/tracing-cross-chain-asset-movements-with-blockscope-9860243e7399) #### • [The Legal Pursuit of Andean Medjedovic](https://research.blockscope.co/andean-medjovic-case-and-investigation) #### • [The Blockchain Bandit Active Again](https://medium.com/@blockscope.co/the-blockchain-bandit-active-again-ef537104f424) #### • [MiCA: The EU’s Crypto Regulation](https://medium.com/@blockscope.co/mica-the-eus-crypto-regulation-2ad056032467) #### • [Investigate Flash Loan Txn](https://research.blockscope.co/investigate-flash-loan-attack) ## For more information, please reach out to us: **E-mail**: **X**: [x.com/BlockscopeCo](https://x.com/BlockscopeCo) **LinkedIn**: [www.linkedin.com/blockscopeco](https://www.linkedin.com/company/blockscopeco)