Prisma Finance

ZachXBT

April

Tornado

Pine

Over the years, crypto hacks have become more elaborate and common. In 2024, the community has seen hundreds of millions swept away from exploits and scams, leaving investors empty-handed. 
Sometimes, the exploiters return the funds and point out a project’s vulnerabilities, helping prevent future incidents. However, it’s more common to see hackers take the stolen funds and flee the scene. 
Crypto investigator ZachXBT unveiled a chain of exploits seemingly connected to the self-called Whitehat hacker responsible for the Prisma Finance exploit that took $12 million last month. 
<h2 style="font-weight: 400;" id="stained-whitehat-hacker">Stained Whitehat Hacker</h2> 
On March 28, Prisma Finance, the Ethereum-based decentralized lending protocol, <a href="https://bitcoinist.com/prisma-finance-hacker-on-chain-11-million-heist/" target="_blank" rel="noopener ">suffered</a> a hack that stole 3,479.24 ETH. After being warned and observing the suspicious activity, Prisma’s team alerted the community. 
At the time, the hacker contacted the Prisma team through an on-chain message, declaring to be a “Whitehat” looking out for users. During their conversation, the exploiter claimed they wanted to “raise better awareness on serious contract audits” and the use of DeFi. 
The following day, the <a href="https://bitcoinist.com/solana-lender-drama-deepens-250-million-outflow-after-founder-quits/" target="_blank" rel="noopener ">lending protocol</a> released a detailed post-mortem of the incident. This post seemingly ruffled the hacker’s feathers, as they demanded that the team change all the “accusatory terms” like ‘exploit’ and ‘hacker.’ 
The messages raised alarms about whether the funds would be returned. Seemingly unsatisfied with the Prisma team’s compliance to edit the post-mortem post, the exploiter asked for a bounty of $3.8 million, worth 34% of the total funds. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 1/ An investigation into the alleged $11.1M <a href="https://twitter.com/PrismaFi?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@PrismaFi</a> exploiter 0x77 (Trung) and the multiple other exploits they are connected to. <a href="https://t.co/QU1Oy7Txbb" rel="nofollow" target="_blank">pic.twitter.com/QU1Oy7Txbb</a> 
 — ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1780244613808160958?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 16, 2024</a>
</blockquote> 
The amount asked was triple the industry standard of 10%. According to the crypto detective, the exploiter was “essentially extorting the team” as the treasury didn’t have enough funds to reimburse the victims. 
Despite the Whitehat claims and apparent discomfort with terms that stated otherwise, the hacker contradicted himself by sending the funds to Tornado Cash. Further investigation by the crypto detective revealed that this Whitehat has several stains. 
<h2 style="font-weight: 400;" id="prisma-s-exploiter-connected-to-several-crypto-hacks">Prisma’s Exploiter Connected To Several Crypto Hacks</h2> 
ZachXBT’s deep dive into the timing of related transactions resulted in the discovery of “activity connected to them on Tron.” One address, TGviNZ, was linked to numerous exploits. 
Per the investigation, TGviNZ was <a href="https://x.com/zachxbt/status/1780244639066243417" target="_blank" rel="noopener nofollow">funded</a> by the Arcade_xyz exploit from March 2023. During this incident, the exploiter requested additional funds from the project via Telegram. 
Similarly, the address was connected to the Pine Protocol exploit from February 2024. This time, the hacker asked for 50% of the funds and allegedly made “additional unreasonable requests over email.” 
<img loading="lazy" decoding="async" class="size-large wp-image-295037 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=926&amp;resize=926%2C659" alt="Crypto hack, crypto exploit" width="926" height="659" srcset="https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=926&amp;resize=926%2C659 926w, https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=590 590w, https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=120 120w, https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=350 350w, https://bitcoinist.com/wp-content/uploads/2024/04/GLSzEtrWsAACZZb.jpeg?w=750 750w" sizes="(max-width: 926px) 100vw, 926px" data-recalc-dims="1"> 
The crypto sleuth then discovered that TGviNZ is linked to the deployer of Modulus protocol, a “decentralized, non-custodian platform.” &nbsp;Further investigation revealed that an X user, “0x77,” was among the few followers of the protocol. 
This proved crucial in piecing together the puzzle, as the Arcade exploiter used the alias “0x77” on Telegram. A deeper look into the phone number, email addresses used, and other details pointed out the same <a href="https://bitcoinist.com/first-conviction-for-crypto-smart-contract-hacking/" target="_blank" rel="noopener ">suspect</a> behind these exploits. 
The details of the suspected exploiter are now in the hands of the Prisma team, which is investigating whether to pursue legal action against the individual in Vietnam and Australia. 
<img loading="lazy" decoding="async" class="alignnone size-large wp-image-295034 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/04/TOTAL_2024-04-17_08-28-11.png?w=980&amp;resize=980%2C468" alt="Crypto, TOTAL," width="980" height="468" srcset="https://bitcoinist.com/wp-content/uploads/2024/04/TOTAL_2024-04-17_08-28-11.png?w=1077 1077w, https://bitcoinist.com/wp-content/uploads/2024/04/TOTAL_2024-04-17_08-28-11.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/04/TOTAL_2024-04-17_08-28-11.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/04/TOTAL_2024-04-17_08-28-11.png?w=980&amp;resize=980%2C468 980w, https://bitcoinist.com/wp-content/uploads/2024/04/TOTAL_2024-04-17_08-28-11.png?w=750 750w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1">

Chain Of Exploits? Investigator Unveils Connection Between Multiple Crypto Hacks

Table of Contents

Bitcoinist

Other articles published on Apr 18, 2024

Binance secures Dubai crypto license after CZ steps down

Bitcoin could hit the $53,000 level, if this happens

80% of locally-assembled smartphones in Kenya sold off in 6 months

XRP Bulls Roar: Analyst Foresees Explosive Surge With ‘God Candle’ On The Horizon

Tornado Cash Reigns Supreme for Crypto Laundering

Fintopio DeFi Wallet Debuts in Open Beta on Telegram and Web App

Join our free newsletter for daily crypto updates!