Crypto scammer returns $34.7 million in stolen belongings after sufferer provides bounty

The crypto scammer who stole 1,155 Wrapped Bitcoin (WBTC), equal to $70.5 million, has begun returning the funds, in keeping with on-chain knowledge.

Blockchain safety agency Peckshield reported that the attacker had returned 50% of the stolen funds— roughly 11,446.87 ETH price $34.7 million—to the sufferer’s tackle as of press time.

10% bounty

This refund comes shortly after the scammer engaged with the sufferer by means of a number of on-chain messages over the previous day.

On Might 3, an unnamed crypto dealer misplaced 1,155 WBTC by means of an address-poisoning phishing scheme. These illicit schemes sometimes lure people into transferring digital belongings to fraudulent addresses owned by malicious actors.

Following the theft, the attacker swiftly transformed the funds into 22,956 ETH and dispersed the digital belongings throughout “a lot of wallets” to obfuscate the path.

Nonetheless, the sufferer proposed providing the perpetrator a ten% bounty in alternate for returning 90% of the stolen funds, cautioning that laundering the cash would show futile.

“We each know there’s no method to clear this funds. You may be traced. We additionally each perceive the ‘sleep nicely’ phrase wasn’t about your ethical and moral qualities. However, we formally admin your proper to the ten%. Ship 90% again,” the sufferer wrote.

On Might 9, the attacker despatched 51 ETH, price greater than $150,000, to the sufferer, together with a message asking the sufferer to offer a Telegram username the place they could possibly be contacted.

Hacker’s profile

Blockchain safety agency Gradual Mist steered that the attacker could be concerned in a number of different phishing assaults concentrating on the Tron and Ethereum blockchains.

The agency mentioned it “noticed that from April 19 to Might 3, [an address associated with the hacker] initiated over twenty thousand small transactions, distributing small quantities of ETH to varied addresses for phishing functions.”

Gradual Mist furthered that a number of IPs suspected for use by the hacker originated from cellular stations in Hong Kong

Talked about on this article