A phishing attack that occurred in September 2023 has resulted in the transfer of $10 million worth of Ether (ETH) to the crypto-mixing protocol known as Tornado Cash. This incident was flagged by CertiK, a blockchain security firm, on March 21. The account linked to the $24 million hack, which took place on September 6, 2023, transferred 3,700 ETH to Tornado Cash. The funds were originally taken from a crypto whale in a phishing incident. The hacker carried out the hack in two transactions, stealing 9,579 stETH and 4,851 rETH from the victim. The victim unknowingly signed an “Increase Allowance” transaction, which granted approval for the hacker to spend ERC-20 tokens belonging to the victim. This attack highlights the risks associated with token allowances and the potential for malicious smart contracts. Following the attack, the hacker exchanged the stolen assets for 13,785 ETH and 1.64 million Dai. Some of the Dai was moved to the FixedFload exchange, while the majority of the stolen funds were transferred to other wallets. Phishing attacks continue to pose a major problem for the crypto industry, with almost $47 million lost to such scams in February alone. The Ethereum network remains a popular target, accounting for 78% of the thefts, with ERC-20 tokens making up 86% of the stolen assets. Token approvals have also caused recent losses, as an old contract previously used by the Dolomite exchange was exploited to drain $1.8 million from users. To prevent further damage, Dolomite’s development team advised users to revoke approvals given to the old contract address. Although some attacks result in significant losses, others are swiftly halted. Layerswap, for example, managed to prevent further breaches on its website after intervention from its domain provider. However, the hackers still managed to drain $100,000 in assets from 50 users. The affected users will be refunded, and additional compensation will be provided by the protocol.
$10M Transferred from 2023 Phishing Incident to Tornado Cash by Skilled Hacker