Bitfinex wallet hacker returns most of the $20 million back to US gov

As a seasoned analyst with years of experience in the ever-evolving landscape of cryptocurrencies, I find myself both intrigued and slightly amused by these recent events. The cat-and-mouse game between hackers and security experts is as old as the internet itself, but it seems to have taken on a new level of complexity with the advent of blockchain technology.


On October 24, an unscrupulous individual managed to siphon around $20 million from a US government account that held funds seized after the 2016 Bitfinex hack. However, within just under 24 hours, this individual returned almost all of the stolen money, returning $19.3 million to the same government account.

As a researcher, I’ve uncovered some intriguing findings. Based on data from Arkham Intelligence, it appears that certain digital wallets linked to the hacker in question have been returning funds to the US government wallet, identifiable by the prefix “0xc9E.” At this moment, approximately 88% of the stolen funds have been recovered.

According to blockchain records, the hacker has apparently returned around 2,412 Ether, 7,200 USDC tied to Circle, and roughly $13.2 million in staked USDC from Aave, which is not redeemable immediately (aUSDC). However, it’s important to note that the funds sent to instant exchanges, estimated to be around $700,000, are not included in this returned total, as pointed out by blockchain investigator ZackXBT.

As a crypto investor, I’ve noticed an alarming rise in hacking incidents and exploits during the third quarter of 2024. The details about the hacker’s identity and their motive remain undisclosed for now, but it’s clear that this trend is cause for concern.

October hacks and malicious attacks

On October 16th, a cross-chain lending protocol named Radiant Capital suffered an exploit and had approximately $50 million stolen. The culprit managed to infiltrate Radiant Capital’s contracts on both the BNB Chain and Arbitrum networks by gaining access to the private keys needed for transaction signing, which were stored within Radiant Capital’s multisignature wallet.

Approximately one week after the exploit, the hacker shifted $52 million in funds to the Ethereum network — making the stolen funds much harder to recover.

On the next day, the user-friendly trading platform Ambient Finance experienced a front-end attack on its website. The Ambient Finance team reported that in a separate occurrence, a hacker managed to breach the website’s domain. This incident did not impact the protocol itself. After regaining control of the domain, Ambient Finance swiftly restored the website services for users.

On October 18th, the service Eigenlayer unfortunately experienced a hack. A cybercriminal managed to take over Eigenlayer’s X social media account and distributed harmful airdrop links to unaware users. The malicious link was active for just a short period before it was removed. At present, the account is operating as usual.

Read More

2024-10-25 20:09