WazirX attacker converts $235 million theft into Ethereum, holds practically 60K ETH

On-chain knowledge exhibits that the WazirX exploiter has transformed a lot of the stolen property from the Indian crypto platform into Ethereum.

On July 18, WazirX was exploited for round $235 million in a number of digital property, with blockchain investigators suggesting that the North Korea-backed Lazarus Group perpetrated the assault.

Whereas the trade shortly applied measures to cease the theft, recovering the funds appears unlikely because the attacker actively converts the stolen property into ETH, the second-largest digital asset by market capitalization.

WazirX exploiter holds practically 60,000 ETH.

Blockchain analyst Lookonchain reported that the WazirX exploiter had transformed a lot of the stolen property to 43,800 ETH, price $149.46 million. This brings the entire ETH within the attacker holding to 59,097 ETH, valued at round $201.67 million.

Market observers steered that the asset conversion was a part of a complicated cash laundering method that additionally entails utilizing crypto mixing companies like Twister Money to obfuscate the transaction trails.

Regardless of this, the exploiter’s handle nonetheless has as much as $15 million price of different comparatively lesser-known digital property left. This contains 1.66 billion DENT, price $1.56 million, and 6.76 million CHR, price $1.72 million, amongst others.

In the meantime, on-chain knowledge exhibits the exploiter despatched 7.7 million DENT, price $7,300, to a brand new Binance deposit handle. Lookonchain stated:

“It’s price noting that the WazirX exploiter deposited 7.7 million DENT ($7.3K) to a Binance deposit handle that has not been used earlier than.”

‘Pressure Majeure’

A autopsy report from the trade confirmed that the affected pockets used Liminal’s companies, a digital asset custody and pockets infrastructure supplier.

WazirX defined that the exploit resulted from discrepancies between the information on Liminal’s interface and the transaction’s content material. It wrote:

“Through the cyber assault, there was a mismatch between the knowledge displayed on Liminal’s interface and what was truly signed. We suspect the payload was changed to switch pockets management to an attacker.”

The trade additionally described the assault as a “drive majeure” occasion past its management and guaranteed it was actively working to get better the stolen funds.

Talked about on this article