Blockchain data reveals that the individual responsible for an address-poisoning attack has returned almost all of the stolen funds, which amounted to 1,155 Wrapped Bitcoin (wBTC) valued at $68 million at the time. The attacker had swapped the funds for Ether (ETH) while in their possession, taking advantage of the falling ETH price. However, they have now sent back approximately 22,960 ETH worth $65.7 million, representing over 96% of the initial stolen amount in terms of USD value.
The victim’s wallet currently shows a balance of over 22,000 ETH. The attack began on May 10 at 8:47 am UTC, with multiple wallets sending ETH to the victim’s account. The first transfer amounted to 29.999 ETH, worth $87,199 based on the ETH price at the time. Over the next day, more than 225 wallet transactions were carried out from various accounts to send ETH to the victim’s address. The transaction values ranged from 29 to 67 ETH. As a result, the victim’s wallet balance reached over 29,000 ETH.
These transfers occurred following a series of exchanges between the victim and the attacker. Initially, the victim had agreed to let the attacker keep 10% of the funds as a reward. However, the attacker has returned over 90% of the stolen funds at the time of this report.
Match Systems, a cybersecurity platform, claimed to have obtained information that strengthened the victim’s position during negotiations with the attacker. This suggests that progress had been made in identifying the attacker’s identity. The platform stated, “The Match Systems team conducted a thorough analysis of the incident and identified several opportunities to enhance the negotiating position for future communication with the attacker. As a result of negotiations, conducted with the involvement of the cybersecurity agency Match Systems and the Cryptex cryptocurrency exchange, the hacker has returned the entire stolen amount of 22,960 ETH to the victim. Currently, the victim has no complaints against the attacker.”
Address poisoning attacks can lead to significant losses for cryptocurrency users. Experts recommend carefully verifying the receiving address before each transaction to avoid falling victim to such attacks.
Related:
DEA gets scammed: Agency loses $55K in address poisoning scheme
Update 5-11-2024 at 3:24 pm: This article has been updated to include additional information from the Match Systems statement.