13 ms·
The hacker has spent the last 11 hours slowky and incrementally converting all the various tokens they got to ETH. They've been using a variety of different def
by X6S1x6Okd1st 4y ago
The hacker has spent the last 11 hours slowky and incrementally converting all the various tokens they got to ETH. They've been using a variety of different defi exchange and have eaten large slippage fees, at least once over 5M lost in slippage.
We're not seeing any else, e.g. laundering through another exchange, splitting into different accounts, automating the liquidation of tokens to ETH, off loading ETH into a cold wallet etc.
The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices
EDIT: first outflows from 0x59abf3837fa962d6853b4cc0a19513aa031fd32b have started, they still haven't liquidated all their PAXG, a stable coin pegged to gold, unclear if it's freezable.
They were able to liquidate all of their USDT except 4M on avalanche, and all of their usdc both of which can be frozen. Dai is a usd pegged stable coin that can't be frozen, they have nearly 1% of it. Note that Dai is heavily exposed to USDC so authorities could pressure USDC to destroy Dai
- deleted 4y ago[deleted]
- FollowingTheDao 4y agoCorporate theft is not a hacking.
- seretogis 4y agoWhen you say "corporate theft" are you referring to theft from corporations or theft by corporations? I'm not sure it's clear which is relevant here.
- zen21 4y ago> The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices How common is the knowledge of these best practices?
- boppo1 4y agoA hacker who got in from the outside would probably be sophisticated enough to at least 1. automate transfers 2. launder through monero or a tumbler or something This looks like someone who barely understands crypto because all of the transfers can be traced, and since they're apparently working manually and slowly, the audit-surface is huge.
- bonestamp2 4y agoWhat are the chances that this is an insider and not an outsider? I ask because the timing of this "hack" is obviously a little suspicious.
- bogota 4y agothe fact that it has been executed so poorly to me seems like it is an insider who woke up and thought they could get away with it because they hd access to the keys
- stephc_int13 4y agoI can't wait to watch the Netflix series. If you think about it, even his name seems to be a troll.
- FormerBandmate 4y agoWouldn’t an insider be an expert on crypto markets? They literally ran one
- matai_kolila 4y agoNot well!
- dmurdoch 4y agoNo. Not all insiders would necessarily be professionals as covering their tracks post crypto hack. They could just be someone who knew they had access to the keys and said "screw it my life is already horrible lets try this". Another option is honestly an insider who got screwed (a lot of employees had a TONNE of money on FTX) selling the keys they knew of to someone else.
- vkou 4y agoThe latter immediately occured to me. It is a lot easier to claim ignorance if your key gets used by someone else to drain the vault, than it is to drain the vault yourself.
- AirStreamer27 4y agoHow can USDC or USDT be frozen?
- X6S1x6Okd1st 4y agoThe smart contacts have a blacklist that the companies can add to, that would disable transfers.
- eightysixfour 4y agoBoth are centrally managed and are semi-regularly frozen at the request of authorities.
- somebodythere 4y agoThe smart contract has an array of frozen addresses that will not be permitted to move funds, which can be edited by Centre and Tether respectively.
- VagueMag 4y agoWhy would the attacker move the funds to any remotely censorable coin like DAI?
- deleted 4y ago[deleted]
- themihai 4y agoI think he tries any avenue available. Even if 50% is lost it's still a good trade.
- VagueMag 4y agoI guess I'm really ignorant of the whole DeFi ecosystem and how it works and so maybe this isn't feasible, but I would think keeping 100% of Bitcoin and Monero (even if their prices crash a further 80%) would be better than going into these very easily controlled stablecoin.
- hamiltonians 4y agoDai cannot be censored by
- VagueMag 4y ago> heavily exposed to USDC
- hamiltonians 4y agothis is not the same as protocol level censorship
- VagueMag 4y agoIf authorities wanted to freeze a subset of DAI, could they do so by directing USDC to refuse to back those tokens?
- deleted 4y ago[deleted]
- wklm 4y agowhat are the best practices for dumping a significant amount of illiquid shitcoins under time pressure?
- papichulo4 4y agoAsking for a friend? :)
- deleted 4y ago[deleted]
- HaZeust 4y agoBulk bridge swap service IMO. Avalanche or Fantom would be your best bet right now.
- bogomipz 4y agoCould you or someone else explain why DeFi is integral to these hacks? The article mentions the decentralized exchange 1inch and you are mentioning Avalanche and Fantom. Is just that that DEX and P2P create levels of indirection that make it much harder to track the movements of the stolen assets?
- HaZeust 4y agoDo bear in mind that I was answering a question about how to swap coins given such a low amount of time that this hacker (likely insider; opinion) had. I named decentralized exchanges because they don't give up the ownerships of their crypto AND they offer bridges/swapping services from one coin to another - which makes it not only harder to track the assets when you're trying to do this sort of process, but it also offers a more streamlined approach for doing the process in the first place - which is swapping a bunch of coins. For sake of lucidity, I want to say that this doesn't necessarily make DeFi integral to these hacks, but it does make the process of liquidating from these hacks easier.
- bogomipz 4y ago
- biztos 4y agoI'm sure this is a total noob comment but I love how the account is named "FTX Accounts Drainer" on Etherscan: https://etherscan.io/address/0x59abf3837fa962d6853b4cc0a19513aa031fd32b https://etherscan.io/address/0x59abf3837fa962d6853b4cc0a1951... [Edit: and also the Heist label is very useful!]
- hi5eyes 4y agocommon for etherscan to label malicious wallets
- api 4y agoIs it a coincidence that the founder of FTX seems to be fleeing to Argentina? Of course one would assume he or his conspirators would do a better job, but maybe not if this busting out was initiated under time pressure. Once again almost everything in cryptocurrency proves to be a scam.
- bboygravity 4y ago"Once again almost everything in cryptocurrency proves to be a scam." This is like saying "once again almost everything in US dollars proves to be a scam" after Lehman fell. The sentence makes no sense at all to me.
- matheusmoreira 4y ago> Once again almost everything in cryptocurrency proves to be a scam. Once again people on HN hate on cryptocurrencies for no good reason. This isn't a cryptocurrency problem, it's a fractional reserve banking problem. These centralized exchanges are unregulated banks in disguise. It's no surprise to anyone that they exhibit all of the problems of unregulated banks. Problems such as "we used customer deposits to gamble, lost everything and are now insolvent". To think one of the reasons cryptocurrency was invented was to end the need for such things...
- jtbayly 4y agoWell, if this was what cryptocurrency was created to prevent, then whether or not it's a scam, it's pretty well clear to me that it's useless.
- goodSteveramos 4y ago>people on HN hate on cryptocurrencies for no good reason. Traditional bankers have spent an incredible amount of time and taken huge political risks to gain hold over the US money supply. They and people in the wall street sphere have a very good reason to hate on crypto, they just dont have any convincing arguments for people like us who dont want them controlling the money supply.
- matheusmoreira 4y agoWeird. Why ETH and not Monero? ETH can be traced.
- hamiltonians 4y agono hurry. it's not like he needs the money now
- smeej 4y agoThere is some hurry. Miners and nodes could theoretically update and refuse transactions that come from these wallets. There would have to be enough of them doing this to prevent the transactions from getting through, which is far from guaranteed, but this is of the sort of scale that it could gain the required support.
- smeej 4y agoThey're largely ERC-20 tokens, which can be swapped for ETH on DEXes. Monero is a whole separate blockchain, and cross-chain swaps are still in their infancy and don't have markets to convert ERC-20 tokens to Monero, or definitely not with any sort of volume. The ETH will probably eventually be laundered and some of the cleaned coins sent places they could eventually be traded for XMR and eventually cashed out, but there's no way to do that quickly, and this needs to be done quickly.
- chitowneats 4y ago"still in their infancy" implies they will eventually mature. Non-zero chance we're watching the final implosion of blockchain based cryptocurrency.
- VectorLock 4y agoI don't think we'll ever see the end of cryptocurrency. Too good of a grift. I wonder if we will reach a point where "crypto" will revert to not meaning "cryptocurrency" though.
- 4y ago
- deleted 4y ago[deleted]
- haldujai 4y ago> The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices This may be an understatement of their skill level. It seems the individual(s) also used a Kraken account to transfer funds and have been identified per their CSO. https://twitter.com/c7five/status/1591434844760076290?s=61&t=cCGgNMSYW0dr0wJBDbn3DA https://twitter.com/c7five/status/1591434844760076290?s=61&t...
- X6S1x6Okd1st 4y agoI believe that is the white hat group. It helps to identify the exact txns & addresses they are referring to here.
- drexlspivey 4y agoLooks like he sent the money to a kraken account under his real name lol. https://cryptoslate.com/ftx-hacker-identity-discovered-by-kraken-exchange-team/ https://cryptoslate.com/ftx-hacker-identity-discovered-by-kr...
- MisterTea 4y agoWhat if its a frame job?
- andrewinardeer 4y agoOr identity theft occured for the malicious KYC process?
- deleted 4y ago[deleted]