4 ms·

Can someone attempt to explain or speculate at what the attacker is doing with their wallet right now? https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0

by apeace 5y ago

Can someone attempt to explain or speculate at what the attacker is doing with their wallet right now? https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e2383e2f96 https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e... As I write this at about 17:00 UTC, they seem to be doing lots of small transactions (about $1 USD), and they are coming "From" many different places, but only showing "To" the "Ronin Bridge Exploiter". I don't understand this stuff well enough to see what it is they're doing, but I'm curious. I'd imagine they're working diligently to secure their rather large fortune...

Jerrrry 5y ago
It will be laundered in millions of $1 transactions, with others that are doing the same. Then it will be sold at a discount for Monero or a shitcoin, and then theyll get a couple thousand dollars in cash in the mail for the rest of their life. im jealous at this point,
- vmception 5y ago
  No they’ll add some liquidity to Tornado cash And then a bunch of other large hacks will notice that Tornado cash is big enough to handle their large amounts too, adding more liquidity to Tornado cash And then some FAANG engineer is going to take their clean $50k paycheck and buy into a new launched token on Uniswap And that token is going to rally 100x because the tornado cash withdrawals keep buying that token And then that engineer is going to sell the tokens into the Uniswap liquidity pool, transfer the Ether to dollars, and report capital gains as just another lucky crypto trader You’re welcome
  - Jerrrry 5y ago
    - vmception 5y ago
      Here is one of many styles of telegram channels that promote newly launched tokens on Uniswap solely for the gamble and fun https://t.me/goobygambles https://t.me/goobygambles
      - Jerrrry 5y ago
        the premise is, though, to lure in others via 1000% fomo -- that is only inflated because of the user buying the questionable tokens, then use their capital for exit liquidity? seems pretty simple
        vmception 5y ago
        Well no, in the way I described its primarily inflated because of your tornado cash notes being withdrawn (by you to virgin addresses) and you directing those addresses to buy the token While you simultaneously get to pretend to be one of the fomo users who also bought the token, from different addresses that are linked to your identity and exchange account The way Uniswap works is that prior buyers are the exit liquidity (look at how liquidity pools work, its different than posted order exchanges so you dont have to wait for people to show up with an order to sell into), and the majority of the prior buyers (because you are those prior buyers) would be the capital withdrawn from tornado cash (the dirty money from the big hack), the other fomo users can sell at a premium too depending on the price they buy So your only goal here is for you and your clean money to blend in with the rest of the clean money crowd by having it promoted on these “degen gambles” channels, just because you don't want a future wiser investigator to suspect this token was created solely for you to cash out your tornado cash money. (Also, dont use someone else’s node over clearnet to do this. Connect to infura over a tor OS (not just the browser) or run your own node.)
  - easrng 5y ago
    The thing is, they didn't. If you check the tx history most of it went to Huobi and some to FTX and Crypto.com
    - vmception 5y ago
      That's pretty funny, good luck with that big attack vector on them
buzzert 5y ago
I think it’s random people just trying to get their name to show up on a currently very popular etherscan address.
- apeace 5y ago
  Ah, thanks. Didn't think of that!
m3nu 5y ago
You can read the messages in those transactions by choosing "view input as...". Pretty funny actually: > Hi. Please donate to innocent Russians population who are being punished! Help Innocent People ($HIP). We are supporting orphans and Ukrainian refugees. https://etherscan.io/tx/0x25d6e35669f2143ab2efaba96aacd543146f5c5ae41a825afbe7b1f3388b442f https://etherscan.io/tx/0x25d6e35669f2143ab2efaba96aacd54314...
apeace 5y ago
As some other commenters pointed out, those small transactions are all spam. So I decided to go back in the transaction history and look at what the attacker has done with the funds. So far, it has all been funneled (through about 2 hops), to something called "Huobi 35", e.g. this transaction[0]. Some of these have taken place in just the last few minutes (17:15 UTC or so). I'm assuming "Huobi 35" is the Huobi exchange?[1] And maybe "Huobi 35" refers to this 35% APY thing they offer?[2] If that's accurate, why would the attacker take this approach? Won't authorities be storming Huobi's offices and taking the ETH? Is it possible that through Huobi the attacker is able to exchange for other coins very quickly? If you look at all the transactions leading to Huobi so far it is only a small percentage of the amount stolen, but it's still many millions of dollars... Also, why'd they wait so long to move into Huobi? [0] https://etherscan.io/tx/0x075df6c4b44733a0e76aa4947b56b4c0c00ec136d7865edc1ac7068264e15704 https://etherscan.io/tx/0x075df6c4b44733a0e76aa4947b56b4c0c0... [1] https://www.huobi.com/ https://www.huobi.com/ [2] https://www.huobi.com/support/en-us/detail/74899843012340 https://www.huobi.com/support/en-us/detail/74899843012340
- babyshake 5y ago
  Huobi is Chinese I believe. One potential side effect of countries like China "banning" cryptocurrency is that they may not be motivated to help in these situations.
- omarfarooq 5y ago
  The 35 refers to this being the 35th address for the Huobi Exchange that Etherscan was able to identify.
- bombcar 5y ago
  There are no authorities who understand this enough to operate that quickly. By the time any authorities care, it'll be long gone from Huobi.
  - giarc 5y ago
    Bingo. Read all the technical language in this single forum post. Now go to your local police office, ask to speak to someone and you'll get the fresh recruit who knows a lot about traffic laws. You might as well be speaking latin to them.

by apeace 5y ago

Jerrrry 5y ago

It will be laundered in millions of $1 transactions, with others that are doing the same. Then it will be sold at a discount for Monero or a shitcoin, and then theyll get a couple thousand dollars in cash in the mail for the rest of their life. im jealous at this point,

vmception 5y ago
No they’ll add some liquidity to Tornado cash And then a bunch of other large hacks will notice that Tornado cash is big enough to handle their large amounts too, adding more liquidity to Tornado cash And then some FAANG engineer is going to take their clean $50k paycheck and buy into a new launched token on Uniswap And that token is going to rally 100x because the tornado cash withdrawals keep buying that token And then that engineer is going to sell the tokens into the Uniswap liquidity pool, transfer the Ether to dollars, and report capital gains as just another lucky crypto trader You’re welcome
- Jerrrry 5y ago
  - vmception 5y ago
    Here is one of many styles of telegram channels that promote newly launched tokens on Uniswap solely for the gamble and fun https://t.me/goobygambles https://t.me/goobygambles
    - Jerrrry 5y ago
      the premise is, though, to lure in others via 1000% fomo -- that is only inflated because of the user buying the questionable tokens, then use their capital for exit liquidity? seems pretty simple
      - vmception 5y ago
        Well no, in the way I described its primarily inflated because of your tornado cash notes being withdrawn (by you to virgin addresses) and you directing those addresses to buy the token While you simultaneously get to pretend to be one of the fomo users who also bought the token, from different addresses that are linked to your identity and exchange account The way Uniswap works is that prior buyers are the exit liquidity (look at how liquidity pools work, its different than posted order exchanges so you dont have to wait for people to show up with an order to sell into), and the majority of the prior buyers (because you are those prior buyers) would be the capital withdrawn from tornado cash (the dirty money from the big hack), the other fomo users can sell at a premium too depending on the price they buy So your only goal here is for you and your clean money to blend in with the rest of the clean money crowd by having it promoted on these “degen gambles” channels, just because you don't want a future wiser investigator to suspect this token was created solely for you to cash out your tornado cash money. (Also, dont use someone else’s node over clearnet to do this. Connect to infura over a tor OS (not just the browser) or run your own node.)
- easrng 5y ago
  The thing is, they didn't. If you check the tx history most of it went to Huobi and some to FTX and Crypto.com
  - vmception 5y ago
    That's pretty funny, good luck with that big attack vector on them

buzzert 5y ago

I think it’s random people just trying to get their name to show up on a currently very popular etherscan address.

apeace 5y ago
Ah, thanks. Didn't think of that!

m3nu 5y ago

You can read the messages in those transactions by choosing "view input as...". Pretty funny actually: > Hi. Please donate to innocent Russians population who are being punished! Help Innocent People ($HIP). We are supporting orphans and Ukrainian refugees. https://etherscan.io/tx/0x25d6e35669f2143ab2efaba96aacd543146f5c5ae41a825afbe7b1f3388b442f https://etherscan.io/tx/0x25d6e35669f2143ab2efaba96aacd54314...

apeace 5y ago

As some other commenters pointed out, those small transactions are all spam. So I decided to go back in the transaction history and look at what the attacker has done with the funds. So far, it has all been funneled (through about 2 hops), to something called "Huobi 35", e.g. this transaction[0]. Some of these have taken place in just the last few minutes (17:15 UTC or so). I'm assuming "Huobi 35" is the Huobi exchange?[1] And maybe "Huobi 35" refers to this 35% APY thing they offer?[2] If that's accurate, why would the attacker take this approach? Won't authorities be storming Huobi's offices and taking the ETH? Is it possible that through Huobi the attacker is able to exchange for other coins very quickly? If you look at all the transactions leading to Huobi so far it is only a small percentage of the amount stolen, but it's still many millions of dollars... Also, why'd they wait so long to move into Huobi? [0] https://etherscan.io/tx/0x075df6c4b44733a0e76aa4947b56b4c0c00ec136d7865edc1ac7068264e15704 https://etherscan.io/tx/0x075df6c4b44733a0e76aa4947b56b4c0c0... [1] https://www.huobi.com/ https://www.huobi.com/ [2] https://www.huobi.com/support/en-us/detail/74899843012340 https://www.huobi.com/support/en-us/detail/74899843012340

babyshake 5y ago
Huobi is Chinese I believe. One potential side effect of countries like China "banning" cryptocurrency is that they may not be motivated to help in these situations.
omarfarooq 5y ago
The 35 refers to this being the 35th address for the Huobi Exchange that Etherscan was able to identify.
bombcar 5y ago
There are no authorities who understand this enough to operate that quickly. By the time any authorities care, it'll be long gone from Huobi.
- giarc 5y ago
  Bingo. Read all the technical language in this single forum post. Now go to your local police office, ask to speak to someone and you'll get the fresh recruit who knows a lot about traffic laws. You might as well be speaking latin to them.