ThepersonbehindtherecentRadiantCapitalexploithasreportedlymovednearlyallofthestolencrypto,valuedatabout$52million,fromLayer-2networkstoEthereum.
BlockchainsecurityfirmPeckShieldsharedtheinformationonOctober24,furtherdampeninganyhopesofrecoveringthefunds.
AttackerAlmostDoneBridgingStolenFunds
AccordingtoPeckShield,theattacker’son-chainfootprintshowedtheyhadbridgedabout20,500ETHtokensfromArbitrumandBinance’sBNBChaintoEthereum.ThefundswerepartoftheOctober16attackthatcompromisedRadiantCapital’ssmartcontracts.
Anotherblockchainsecuritycompany,AnciliaInc.,wasthefirsttodetectthesuspiciousactivity,whichinitiallyresultedinthelossofatleast$18millionworthofcryptoassetsfromRadiant’sliquiditypoolontheBinancenetwork.Thehackerthenextendedtheattacktothedecentralizedfinance(DeFi)protocol’spoolonArbitrum,furtherescalatingthelosses.
Apost-mortemoftheattackshowedthattheperpetratorgainedcontrolbycompromisingamulti-signaturewalletthatsecuredRadiant’sfunds.Theywerethenabletoobtaintheprivatekeysofthreeoutofelevensigners,givingthemtheabilitytoupgradetheplatform’scontractsandtransferownership.
Itenabledthebadactortodrainseveraltradingpools,includingthoseholdingpopularassetssuchasUSDC,USDT,wBTC,wETH,andBNB.
RecoveryEffortsinJeopardy?
TheOctober16incidentisthesecondtimehackershavetargetedRadiantthisyear.InJanuary,theDeFiplatformlost$4.5millionduetoavulnerabilityinitssmartcontract.
ThecompanyhassinceengagedwithU.S.lawenforcement,includingtheFBI,andpartneredwithcybersecurityoutfitslikeSEAL911andZeroShadowinanattempttorecoverthestolenmoney.
However,thethief’smovetoEthereumsuggeststheymaybetryingtohidetheirtrail,makingrecoveryeffortsthatmuchharder.Further,Radianthasadmittedthat,giventhesophisticationoftheexecution,eventheincreasedsecuritymeasuresithasnowputinplacemaynothavebeenenoughtopreventtheexploit.
MovingfundstoEthereumisoftenthelaststepbeforecriminalslaunderstolenmoneythroughcryptomixerslikeTornadoCash.CryptoPotatohasreportedsuchincidentsinthepast,includingtheinfamous$235millionWazirXhackerwhotransferredtheirillicitgainsinbatchessincetheystoleitinmid-July.
cryptopotato.com