Unizen

when

Tornado Cash

Pancake Bunny

Tornado

<p class="is-style-lead">The attacker behind the Unizen hack has moved over $2 million of stolen assets to Tornado cash more than four months after the attack.</p> 
<p>According to blockchain security firm PeckShield, the attacker laundered a total of 865.4 ETH (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noreferrer noopener">ETH</a>), approximately $2.16 million at the time.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="">#PeckShieldAlert</a> <a href="https://twitter.com/unizen_io?ref_src=twsrc%5Etfw" target="_blank" rel="">@unizen_io</a> Exploiter-labeled address has transferred 865.4 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="">$ETH</a> (worth ~$2.16M) to <a href="https://twitter.com/hashtag/Tornadocash?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="">#Tornadocash</a> <a href="https://t.co/ndJiSPcNeV" target="_blank" rel="">pic.twitter.com/ndJiSPcNeV</a></p>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1821065531073724876?ref_src=twsrc%5Etfw" target="_blank" rel="">August 7, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The routing of funds began with the attacker transferring 2,179,859 DAI (<a href="https://crypto.news/price/dai/" target="_blank" rel="noreferrer noopener">DAI</a>)from the wallet used in the exploit to an unknown wallet identified by “0X866…84d7” in two separate transactions.</p> 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXf7UoO0cIt3XK4hpJI5Nqc5h61Qt7zUgT5h0kx-3aQoj7_loVcMqbZmr_cYVOy8-rHTWX5E9RsiOFrpNJrGh4qhV8UH4uvvt2cIfEGVQ519fXMmOzYLAAZFQ8vWRYVKBobjobJ_JH0iNb8fVj0cD9xp6tw?key=WlWAI_fuwQAxYI0BzRhweA" alt="Unizen attacker moves $2.1m via Tornado Cash - 19">
 <figcaption class="wp-element-caption">
  Attacker moves funds from wallet used in the exploit | Source: <a href="https://etherscan.io/token/0x6b175474e89094c44da98b954eedeac495271d0f?a=0xb660cae1a59336676ea1887b15eb3c0badb90d78" target="_blank" rel="">Etherscan</a>
 </figcaption>
</figure> 
<p>Subsequently, the hacker started swapping the DAI for ETH on Uniswap before <a href="https://etherscan.io/tx/0x670f2ca17f8237754f1b5f136121c35d95bb01814a70c5e281c172defc8dbb08" target="_blank" rel="">transferring them</a> to Tornado Cash via 26 different transactions.</p> 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfNjWiMLe0DD8cS02rocl57U3vhQf12s-I2Kd8jB6i0TI5aoqj6RJffnuRsGW5K4CWyHebGYnwGPygrY-oF-esD4vUe0PSvj6MnTSUMyrUt8uP7xzST8muqbSndEhRThO1WxfQOyxw5M52yobWeJhEb_yk?key=WlWAI_fuwQAxYI0BzRhweA" alt="Unizen attacker moves $2.1m via Tornado Cash - 20">
 <figcaption class="wp-element-caption">
  Swapped ETH being transferred to Tornado cash | Source: <a href="https://etherscan.io/tx/0x670f2ca17f8237754f1b5f136121c35d95bb01814a70c5e281c172defc8dbb08" target="_blank" rel="">Etherscan</a>
 </figcaption>
</figure> 
<p>At the time of writing, both the exploiter’s wallets had zero balances.</p> 
<p>The funds were moved 151 days after the March 9 attack, when PeckSheild identified an “approve issue” with the platform. $2.1 million worth of <a href="https://crypto.news/price/tether/" target="_blank" rel="noreferrer noopener">USDT </a>had been drained and later converted into DAI.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Hi <a href="https://twitter.com/unizen_io?ref_src=twsrc%5Etfw" target="_blank" rel="">@unizen_io</a> you may want to a look. It looks like an approve issue with &gt;2m loss already.<br><br>If you have approved the following trade aggregator, please revoke ASAP: <br><br>eth: 0xd3f64baa732061f8b3626ee44bab354f854877ac <a href="https://t.co/Rq1AMxrrgs" target="_blank" rel="">pic.twitter.com/Rq1AMxrrgs</a></p>— PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1766210445415727608?ref_src=twsrc%5Etfw" target="_blank" rel="">March 8, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The Unizen team attempted to contact the hacker on-chain and offer a 20% bounty in return for the stolen assets but to no avail.</p> 
<p> You might also like: <a href="https://crypto.news/unizen-to-reimburse-victims-after-2-1-million-defi-breach/"> Unizen to reimburse victims after $2.1 million defi breach </a> </p> 
<p>A <a href="https://crypto.news/unizen-to-reimburse-victims-after-2-1-million-defi-breach/" target="_blank" rel="noreferrer noopener">reimbursement plan was announced</a> on March 11, spearheaded by Unizen CEO Sean Noga, who used his personal funds to compensate users. The funds would be compensated in USDT and <a href="https://crypto.news/price/USD-COIN/" target="_blank" rel="noreferrer noopener">USDC </a>for victims who lost less than $750,000, while the cases above the threshold would addressed individually.</p> 
<p>Attackers employ various means to move stolen assets, with cryptocurrency mixers being <a href="https://crypto.news/lazarus-group-tornado-cash-laundering/" target="_blank" rel="noreferrer noopener">the most common tool</a>.&nbsp;</p> 
<p>Last month, on-chain sleuth ZachXBT reported that the hackers behind the $308 million DMM Bitcoin (<a href="https://crypto.news/price/bitcoin/" target="_blank" rel="noreferrer noopener">BTC</a>) hack were <a href="https://crypto.news/lazarus-group-allegedly-moves-stolen-funds-from-308m-dmm-bitcoin-hack/" target="_blank" rel="noreferrer noopener">laundering stolen assets via Huione Guarantee</a>, an online marketplace that <a href="https://crypto.news/cambodian-marketplace-huione-guarantee-became-hub-for-crypto-scammers-elliptic/" target="_blank" rel="noreferrer noopener">facilitates various scams and related services</a>.</p> 
<p>Meanwhile, attackers behind the flash loan attack on Binance Smart Chain-based defi protocol Pancake Bunny were seen <a href="https://crypto.news/hackers-use-stolen-funds-to-buy-eth-amid-price-crash/" target="_blank" rel="noreferrer noopener">buying the Ethereum dip</a> on Aug. 5, when the second largest cryptocurrency recorded a <a href="https://crypto.news/ethereum-nosedives-32-weekly-drop-largest-ytd-loss/" target="_blank" rel="noreferrer noopener">double-digit drop</a>.</p> 
<p> Read more: <a href="https://crypto.news/unizen-launches-trade-aggregator-v1-supporting-70-dexes/"> Unizen Launches Trade Aggregator V1 Supporting 70 DEXes </a> </p>

Unizen attacker moves $2.1m via Tornado Cash

crypto.news

Other articles published on Aug 7, 2024

TRON Experiences Significant Losses Due to Market Volatility

SEC Pushes Back Against Coinbase’s Demand for Gensler Emails on Digital Assets

Cryptocurrency dogwifhat Up More Than 8% In 24 hours

Grayscale Introduces Bittensor and Sui Trusts for Crypto Investment

Price analysis 8/7: BTC, ETH, BNB, SOL, XRP, DOGE, TON, ADA, AVAX, SHIB

Siebert and INX enter into Referral Agreement for the Introduction of On-Chain Real World Asset (...

Join our free newsletter for daily crypto updates!