Umbra Shuts Down After Hackers Launder $800K in Stolen Crypto Through Protocol

by

Umbra shuts front end after hackers move stolen funds through protocol

Umbra, a cryptocurrency system designed to protect user privacy, has temporarily shut down its website after hackers used it to transfer funds stolen in recent high-profile attacks.

Summary

  • Umbra shut its front end after hackers moved about $800,000 in stolen funds through it.
  • The protocol said its smart contracts remain live despite the hosted website entering maintenance mode.
  • Roman Storm said front-end changes may still be viewed as protocol control by authorities.

The team explained that this change is designed to protect users while they continue working to fix the system and make it more secure against attacks.

Umbra has confirmed that around $800,000 in stolen money was processed through its system. As a result, they’ve temporarily taken their website offline to investigate and prevent any interference with the recovery of these funds. They plan to bring the site back online once they’re confident it won’t hinder the ongoing investigation.

Umbra takes site offline

Umbra revealed the decision in a post on X (formerly Twitter) on Tuesday. They explained that this came after discovering funds from several recent, well-known hacks had been processed through their system.

The project took action when it discovered stolen cryptocurrency had passed through its system. Shutting down the affected part of the platform was a way to disrupt the attackers and help investigators with the recovery process.

Umbra clarified that the shutdown only impacts its user interface. The team emphasized that the underlying smart contracts are still active on the blockchain and can’t be turned off by them.

The company also noted that users can continue to access the software’s source code by downloading it and running it on their own computers or servers. Umbra acknowledged they have no way to prevent people from using these alternative methods.

Protocol says its design does not hide the sender

Umbra explains that its privacy features only hide the recipient’s identity, not the sender’s. The developers believe the system wouldn’t be very useful for criminals attempting to conceal the origins of illegally obtained funds.

Umbra stated that they can trace all the stolen money as it went through their system, and they’re working with security experts to investigate. They are fully cooperating with the ongoing investigation.

This development follows closely after the Kelp exploit, where over $280 million was stolen from the protocol. Investigations suggest the attacker attempted to use Umbra to transfer funds from Ethereum to Bitcoin.

Security researchers have traced the recent Kelp hack back to the Lazarus Group, a hacking organization believed to be based in North Korea. This group is already subject to strict penalties from the US government, and cryptocurrency companies are now working to prevent them from accessing or transferring the funds they stole.

Roman Storm says front-end pause may not satisfy authorities

As an analyst, I’ve been following the situation with Umbra and Tornado Cash closely. Roman Storm, one of Tornado Cash’s founders, believes their recent steps might not be sufficient to protect the project from legal challenges. He points out that in the past, prosecutors have considered control over the user interface – the ‘front-end’ – as evidence of control over the entire protocol itself, which could be problematic.

Storm explained that prosecutors accused him of lying when he stated he had no control over Tornado Cash. He believes authorities might consider modifying the user interface as evidence of controlling the entire system.

He explained that having the ability to modify the user interface – and continue improving it with new versions hosted on IPFS – means developers have complete control. This highlights the ongoing legal discussion about the accountability of developers who create open-source cryptocurrency tools.

The discussion around security has intensified as more cyberattacks target public blockchain systems. Umbra’s approach demonstrates how developers are working to reduce harmful activity, even though they can’t completely control decentralized technologies.

DeFi security pressure rises after another exploit

The Umbra incident happened while the crypto market was already dealing with another security issue. Volo Protocol, a platform that allows users to stake their crypto on Sui, reported a loss of around $3.5 million in Bitcoin, gold-backed tokens, and USD Coin.

Volo immediately secured the compromised accounts, notified the Sui Foundation and its partners, and then blocked $500,000 in stolen funds. They’ve also committed to covering the financial losses themselves, so users won’t be affected.

These recent incidents are increasing scrutiny on DeFi platforms and the tools they use. Projects are now being carefully watched to see how quickly they act when funds are stolen and start being transferred.

Read More

2026-04-22 10:44