WBTC thief returns $71 million worth of stolen funds

As a seasoned crypto investor who has gone through my fair share of ups and downs in this volatile market, I can’t help but be intrigued by this recent turn of events. The news of $71 million worth of stolen cryptocurrencies being returned to the victim is certainly a welcome relief after the high-profile phishing scam that rocked the community just a few weeks ago.


In an unexpected and puzzling development, the perpetrator of a wallet poisoning scam that resulted in the theft of approximately $71 million in cryptocurrencies has returned the ill-gotten gains to their rightful owner.

An unidentified hacker transferred back approximately $71 million in Ether (ETH) tokens on May 12, following a well-publicized phishing attack. The intricacies of this event were elaborated in a public post by the blockchain security company Lookonchain on May 13.

“SlowMist_Team released a report on this incident 3 days ago, tracking multiple attacker’ IPs possibly from Hong Kong (the use of VPNs has not been ruled out). After that, the attacker replied to the whale and returned all the funds.”

WBTC thief returns $71 million worth of stolen funds

It’s unexpected news following the May 3rd incident where an investor transferred $71 million in Wrapped Bitcoin (WBTC) to a fraudulent wallet, having unwittingly fallen prey to a wallet poisoning scheme. The con artist had crafted a wallet address with similar-looking alphanumeric characters and initiated a small transaction towards the victim’s account.

As a researcher studying investment transactions, I’ve noticed that many investors follow a common practice when validating wallet addresses for transferring funds. They check the first and last few characters and find them matching before proceeding with the transaction. In this particular case, 97% of the assets were transferred to the suspect address. However, it’s essential to pay close attention to the middle characters as well. Although they are often hidden on platforms for aesthetic reasons, they play a crucial role in ensuring the wallet address is accurate and belongs to the intended recipient.

White hat hacker, good samaritan, or scared thief?

Although the person involved returned the stolen funds, their past on-chain transactions seem to indicate that they didn’t originally plan to carry out such an action.

As a crypto investor, if I unfortunately found myself in possession of stolen funds, I would swiftly convert the 1,155 WBTC into around 23,000 ETH. This maneuver is a common tactic among malicious hackers, aiming to launder their ill-gotten gains through privacy protocols and crypto mixing services like Tornado Cash.

As a crypto investor, I can tell you that on May 8th, an attacker began transferring my stolen funds to more than 400 different crypto wallets. Eventually, these transactions led to over 150 unique wallet addresses, but in the end, the attacker returned the assets to me or someone else.

WBTC thief returns $71 million worth of stolen funds

After on-chain security company SlowMist released an analysis indicating possible Hong Kong origins of the attacker’s IP addresses, the stolen funds were swiftly returned, hinting that the culprit may have been spooked by the potential repercussions.

WBTC thief returns $71 million worth of stolen funds

According to a May 10 report by SlowMist, the $71 million theft linked to the WBTC thief is just a portion of the overall phishing attempts connected to this case.

“Upon investigating this fee address, we observed that from April 19 to May 3, this address initiated over 20,000 small transactions, distributing small amounts of ETH to various addresses for phishing purposes.”

As a crypto investor keeping track of security breaches and scams in the industry, I’ve noticed that the total amount of cryptocurrency stolen reached a historically low level in April, with approximately $25.7 million worth of digital assets being taken through hacks and scams. This is according to on-chain intelligence firm CertiK, which has been monitoring this data since early 2021.

Read More

2024-05-13 15:28