Unizen

when

Tornado Cash

Pancake Bunny

Tornado

<p class="is-style-lead">The attacker behind the Unizen hack has moved over $2 million of stolen assets to Tornado cash more than four months after the attack.</p> 
<p>According to blockchain security firm PeckShield, the attacker laundered a total of 865.4 ETH (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noreferrer noopener">ETH</a>), approximately $2.16 million at the time.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="">#PeckShieldAlert</a> <a href="https://twitter.com/unizen_io?ref_src=twsrc%5Etfw" target="_blank" rel="">@unizen_io</a> Exploiter-labeled address has transferred 865.4 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="">$ETH</a> (worth ~$2.16M) to <a href="https://twitter.com/hashtag/Tornadocash?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="">#Tornadocash</a> <a href="https://t.co/ndJiSPcNeV" target="_blank" rel="">pic.twitter.com/ndJiSPcNeV</a></p>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1821065531073724876?ref_src=twsrc%5Etfw" target="_blank" rel="">August 7, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The routing of funds began with the attacker transferring 2,179,859 DAI (<a href="https://crypto.news/price/dai/" target="_blank" rel="noreferrer noopener">DAI</a>)from the wallet used in the exploit to an unknown wallet identified by “0X866…84d7” in two separate transactions.</p> 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXf7UoO0cIt3XK4hpJI5Nqc5h61Qt7zUgT5h0kx-3aQoj7_loVcMqbZmr_cYVOy8-rHTWX5E9RsiOFrpNJrGh4qhV8UH4uvvt2cIfEGVQ519fXMmOzYLAAZFQ8vWRYVKBobjobJ_JH0iNb8fVj0cD9xp6tw?key=WlWAI_fuwQAxYI0BzRhweA" alt="Unizen attacker moves $2.1m via Tornado Cash - 19">
 <figcaption class="wp-element-caption">
  Attacker moves funds from wallet used in the exploit | Source: <a href="https://etherscan.io/token/0x6b175474e89094c44da98b954eedeac495271d0f?a=0xb660cae1a59336676ea1887b15eb3c0badb90d78" target="_blank" rel="">Etherscan</a>
 </figcaption>
</figure> 
<p>Subsequently, the hacker started swapping the DAI for ETH on Uniswap before <a href="https://etherscan.io/tx/0x670f2ca17f8237754f1b5f136121c35d95bb01814a70c5e281c172defc8dbb08" target="_blank" rel="">transferring them</a> to Tornado Cash via 26 different transactions.</p> 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfNjWiMLe0DD8cS02rocl57U3vhQf12s-I2Kd8jB6i0TI5aoqj6RJffnuRsGW5K4CWyHebGYnwGPygrY-oF-esD4vUe0PSvj6MnTSUMyrUt8uP7xzST8muqbSndEhRThO1WxfQOyxw5M52yobWeJhEb_yk?key=WlWAI_fuwQAxYI0BzRhweA" alt="Unizen attacker moves $2.1m via Tornado Cash - 20">
 <figcaption class="wp-element-caption">
  Swapped ETH being transferred to Tornado cash | Source: <a href="https://etherscan.io/tx/0x670f2ca17f8237754f1b5f136121c35d95bb01814a70c5e281c172defc8dbb08" target="_blank" rel="">Etherscan</a>
 </figcaption>
</figure> 
<p>At the time of writing, both the exploiter’s wallets had zero balances.</p> 
<p>The funds were moved 151 days after the March 9 attack, when PeckSheild identified an “approve issue” with the platform. $2.1 million worth of <a href="https://crypto.news/price/tether/" target="_blank" rel="noreferrer noopener">USDT </a>had been drained and later converted into DAI.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Hi <a href="https://twitter.com/unizen_io?ref_src=twsrc%5Etfw" target="_blank" rel="">@unizen_io</a> you may want to a look. It looks like an approve issue with &gt;2m loss already.<br><br>If you have approved the following trade aggregator, please revoke ASAP: <br><br>eth: 0xd3f64baa732061f8b3626ee44bab354f854877ac <a href="https://t.co/Rq1AMxrrgs" target="_blank" rel="">pic.twitter.com/Rq1AMxrrgs</a></p>— PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1766210445415727608?ref_src=twsrc%5Etfw" target="_blank" rel="">March 8, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The Unizen team attempted to contact the hacker on-chain and offer a 20% bounty in return for the stolen assets but to no avail.</p> 
<p> You might also like: <a href="https://crypto.news/unizen-to-reimburse-victims-after-2-1-million-defi-breach/"> Unizen to reimburse victims after $2.1 million defi breach </a> </p> 
<p>A <a href="https://crypto.news/unizen-to-reimburse-victims-after-2-1-million-defi-breach/" target="_blank" rel="noreferrer noopener">reimbursement plan was announced</a> on March 11, spearheaded by Unizen CEO Sean Noga, who used his personal funds to compensate users. The funds would be compensated in USDT and <a href="https://crypto.news/price/USD-COIN/" target="_blank" rel="noreferrer noopener">USDC </a>for victims who lost less than $750,000, while the cases above the threshold would addressed individually.</p> 
<p>Attackers employ various means to move stolen assets, with cryptocurrency mixers being <a href="https://crypto.news/lazarus-group-tornado-cash-laundering/" target="_blank" rel="noreferrer noopener">the most common tool</a>.&nbsp;</p> 
<p>Last month, on-chain sleuth ZachXBT reported that the hackers behind the $308 million DMM Bitcoin (<a href="https://crypto.news/price/bitcoin/" target="_blank" rel="noreferrer noopener">BTC</a>) hack were <a href="https://crypto.news/lazarus-group-allegedly-moves-stolen-funds-from-308m-dmm-bitcoin-hack/" target="_blank" rel="noreferrer noopener">laundering stolen assets via Huione Guarantee</a>, an online marketplace that <a href="https://crypto.news/cambodian-marketplace-huione-guarantee-became-hub-for-crypto-scammers-elliptic/" target="_blank" rel="noreferrer noopener">facilitates various scams and related services</a>.</p> 
<p>Meanwhile, attackers behind the flash loan attack on Binance Smart Chain-based defi protocol Pancake Bunny were seen <a href="https://crypto.news/hackers-use-stolen-funds-to-buy-eth-amid-price-crash/" target="_blank" rel="noreferrer noopener">buying the Ethereum dip</a> on Aug. 5, when the second largest cryptocurrency recorded a <a href="https://crypto.news/ethereum-nosedives-32-weekly-drop-largest-ytd-loss/" target="_blank" rel="noreferrer noopener">double-digit drop</a>.</p> 
<p> Read more: <a href="https://crypto.news/unizen-launches-trade-aggregator-v1-supporting-70-dexes/"> Unizen Launches Trade Aggregator V1 Supporting 70 DEXes </a> </p>

Unizen attacker moves $2.1m via Tornado Cash

crypto.news

Other articles published on Aug 7, 2024

Cryptocurrency Hedera Falls More Than 6% In 24 hours

Core Foundation Launches Dual Staking to Enhance Bitcoin Yields

Cryptocurrency Internet Computer Decreases More Than 7% Within 24 hours

Grayscale Introduces Bittensor and Sui Trusts for Crypto Investment

Elon Musk's Vision For X Everything App Advances: Could Dogecoin Skyrocket With Payments Launch?

Siebert and INX enter into Referral Agreement for the Introduction of On-Chain Real World Asset (...

Join our free newsletter for daily crypto updates!