Ethereum

Refund

Block

An Ethereum (ETH) transaction incurred a fee of 288 ETH, or $700K. The user produced a zero-value transaction with an extremely high fee, which turned out to be the work of a validator withdrawal exploit.&nbsp; 
A single Ethereum (ETH) transaction came with a fee of 288 ETH, or $700K. Even during periods of peak activity, a fee of this size is an outlier. The initial suspicions of a hack were confirmed later, as on-chain researchers noted the presence of a smart contract that was capable of intercepting ETH withdrawn from validators. 
However, this time, the fee does not seem to be entirely lost. The fee went into a <a href="https://etherscan.io/tx/0xe9470f1840cc1e89993be445950111a417ba7df0cc2bb133b27baa55a8ae4f40#statechange" rel="nofollow noopener" target="_blank">block producer</a> wallet, which then <a href="https://etherscan.io/tx/0x3718e52997c3f70f54074d85dd7d1ccefb160d746865314ec7e2412ece0f6961" rel="nofollow noopener" target="_blank">sent</a> it to the Stakefish Service. The transaction is more complicated, since the funds were not sent for staking, but sent as a fee, which will have to be processed differently.&nbsp; 
<figure id="attachment_597847" aria-describedby="caption-attachment-597847" style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" class="wp-image-597847 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/10/StakefishTransactionOct82024.png" alt="A user paid $700K to transact Ethereum (ETH), white hat hackers try to save the funds" width="1360" height="42" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/10/StakefishTransactionOct82024.png 1360w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/StakefishTransactionOct82024-300x9.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/StakefishTransactionOct82024-1200x37.png 1200w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/StakefishTransactionOct82024-768x24.png 768w" sizes="(max-width: 1360px) 100vw, 1360px">
 <figcaption id="caption-attachment-597847" class="wp-caption-text">
 A hacker redirected 288 ETH and sent it as a fee to StakeFish. | Source: <a href="https://etherscan.io/tx/0x3718e52997c3f70f54074d85dd7d1ccefb160d746865314ec7e2412ece0f6961" rel="nofollow noopener" target="_blank">Etherscan</a>
 </figcaption>
</figure> 
The rogue fee was not due to gas congestion, as the current <a href="https://etherscan.io/gastracker" rel="nofollow noopener" target="_blank">price</a> conditions on Ethereum are close to the average. 
Usually, the Stakefish fee recipient <a href="https://etherscan.io/address/0xffee087852cb4898e6c3532e776e68bc68b1143b" rel="nofollow noopener" target="_blank">contract</a> receives small amounts of ETH from block builders, especially BeaverBuild. Sending the funds as a fee is seen as a way for the hacker to burn their tracks, after deciding not to withdraw the ETH.&nbsp; 
<h3 id="span-style-font-weight-400-on-chain-research-shows-potentially-compromised-eth-withdrawal-span">On-chain research shows potentially compromised ETH withdrawal</h3> 
On-chain researchers noticed the transaction may not be an accident but the work of a hacker. The MEV Refund account investigated what he sees as a case of a compromised withdrawal wallet. The researcher reached out to Stakefish for the potential to return the funds to the original owner.&nbsp; 
<blockquote class="twitter-tweet" data-theme="dark"> 
 Hi <a href="https://twitter.com/stakefish?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@stakefish</a> , I’m helping whitehat a compromised withdrawal address. 
 Unfortunately, it seems that if the bad guys can’t have it, nobody can 😢 
 Any chance you can return those stolen funds to the rightful owner?<a href="https://t.co/4TPQ4U6vuG" rel="nofollow" target="_blank">https://t.co/4TPQ4U6vuG</a> <a href="https://t.co/PA5CxbXayH" rel="nofollow" target="_blank">pic.twitter.com/PA5CxbXayH</a> 
 — MevRefund (@MevRefund) <a href="https://twitter.com/MevRefund/status/1843518983225684297?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">October 8, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Other researchers see the reason as a ‘smart contract from hell’, a flawed redirecting of funds. Since the hacker may have feared tracking and discovery, the fee was <a href="https://etherscan.io/tx/0x3718e52997c3f70f54074d85dd7d1ccefb160d746865314ec7e2412ece0f6961" rel="nofollow noopener" target="_blank">sent</a> for staking and may not be recovered immediately. MEV Refund did not disclose more details, but has been working on similar withdrawal issues from validators and potentially recoverable lost ETH.&nbsp; 
<h3 id="span-style-font-weight-400-receiving-rewards-from-validators-has-become-a-vector-of-attack-span">Receiving rewards from validators has become a vector of attack&nbsp;</h3> 
The original wallet which created the high-fee transaction is also not a naive user. The address looks like a hub to redistribute compromised ETH withdrawals from validators. 
The wallet is labeled as <a href="https://app.nansen.ai/profiler?address=0xd8172675fce3a437c58430c25c3f9b56f2ab21fc&amp;name=0xd8172675fce3a437c58430c25c3f9b56f2ab21fc&amp;chain=ethereum&amp;tab=counterparties" rel="nofollow noopener" target="_blank">ETH Withdrawer</a> and has multiple high-value counterparties, including MEV services, DEX traders, MetaMask traders and power users. 
<figure id="attachment_597848" aria-describedby="caption-attachment-597848" style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" class="wp-image-597848 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/10/MEVRefundOct82024.png" alt="A user paid $700K to transact Ethereum (ETH), white hat hackers try to save the funds" width="1361" height="80" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/10/MEVRefundOct82024.png 1361w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/MEVRefundOct82024-300x18.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/MEVRefundOct82024-1200x71.png 1200w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/MEVRefundOct82024-768x45.png 768w" sizes="(max-width: 1361px) 100vw, 1361px">
 <figcaption id="caption-attachment-597848" class="wp-caption-text">
 MEV Refund intercepts a transaction of 96 ETH. | Source: <a href="https://app.nansen.ai/profiler?address=0xc13ced137e90bc695cb77288962280516a2f9b8b&amp;name=0xc13ced137e90bc695cb77288962280516a2f9b8b&amp;chain=ethereum&amp;tab=transactions" rel="nofollow noopener" target="_blank">Nansen</a>
 </figcaption>
</figure> 
The wallet’s history shows inflows of small amounts of ETH, moving through what looks like a burn address and into the withdrawal address. Before the 288 ETH transfer, the ETH Withdrawer grabbed another 96 ETH. Those funds, however, were secured by the white hat hacker, MEV Refund.&nbsp; 
Setting up an Ethereum validator withdrawal address is an involved <a href="https://someresat.medium.com/guide-to-configuring-withdrawal-credentials-on-ethereum-812dce3193a" rel="nofollow noopener" target="_blank">process</a> and has the potential to be compromised on some of the steps. Unstaking ETH from the beacon chain may trigger the funds to be sent to a hacker’s address, where they can be moved in multiple ways. Some of the mnemonic phrases created to withdraw from validators can be exposed, leading to the loss of funds.&nbsp; 
Some withdrawal attempts or compromised wallets can be fixed through white-hat bot experts. In cases of a wrong or compromised validator withdrawal address, a transaction can be ordered to front-run the hacker. However, those transactions can be expensive and a fee and tip war may wipe out a large part of the funds.&nbsp; 
One of the potential vectors of withdrawal mistakes are user errors. However, lately, there are also data of block builders being spammed with requests that could redirect some of the transactions. Block builders are supposed to prevent transaction hijacking, but some <a href="https://x.com/MevRefund/status/1843007712516600318" rel="nofollow" target="_blank">builders</a> may be allowing rogue transactions into private blocks. 
In the past, highly expensive blocks were also produced with significant fees. This was a way to launder ETH, by sending it through a miner’s wallet. The fee route was simply a way to stake ETH, by going through intermediary addresses.&nbsp;&nbsp; 
The current Ethereum landscape is more competitive, with potential pitfalls from smart contracts and transaction hijacking. Private pools being compromised may take another hit against DEX trading. Currently, private pools get spammed with attempts to sandwich some trades, but there may be hidden attempts to sandwich even paid, private transactions. 
Cryptopolitan reporting by Hristina Vasileva

A user paid $700K to transact Ethereum (ETH), white hat hackers try to save the funds

Table of Contents

Cryptopolitan_News

Other articles published on Oct 8, 2024

Analyst Predicts Bitcoin Rally with Critical Price Recovery

Top 5 Cryptos Set to Deliver 10000% Gains: Secure Your Millionaire Portfolio by 2026

Just In: Crypto.com Sues SEC Over Cryptocurrency Regulation

Toncoin's Surge to $5.804 Stalls—Is a Big Breakout Ahead?

SUI leads top gainers as open interest hits all-time high

Eralmonum App Review 2024: Scam Or Legit? – User Feedback!

Join our free newsletter for daily crypto updates!