WBTC Thief Returns $71 Million After Investigation Success

As a seasoned crypto investor with a few scares under my belt, I can’t help but feel a mix of relief and caution after hearing about the recent $71 million cryptocurrency heist that ended with the attacker returning all the funds. The incident serves as yet another reminder of the importance of staying vigilant in this space.


Recently, an individual who had pilfered $71 million in cryptocurrency from a victim has returned the entire sum. This came to light after several investigative firms, which scrutinize blockchain transactions, detected the theft and alerted the authorities.

An unknown individual returned approximately $71 million in Ether (ETH) tokens on May 12, after a high-profile phishing scam drew significant attention from various blockchain investigation teams. Lookonchain, a leading on-chain security company, offered an extensive examination of the incident in a blog post published on May 13.

Three days ago, SlowMist_Team published a report detailing the suspected attackers’ IP addresses, which may be based in Hong Kong; however, the use of VPNs is still under investigation. Following this disclosure, the attacker interacted with the whale and restored the stolen funds to their original state.

As a crypto investor, I can share an incident that took place just over a week ago. I was startled to learn that a significant player in the market, known as a “whale,” had lost a substantial amount of Wrapped Bitcoin (WBTC), equivalent to around $71 million. This unfortunate event transpired on May 3rd due to a cunning phishing attack.— Lookonchain (@lookonchain) May 12, 2024

As a researcher investigating this incident, I can describe it as follows: On May 3rd, an individual fell victim to a cunning scam. This person was deceived into transferring their cryptocurrency to what appeared to be a legitimate wallet. However, the scammer had meticulously crafted a fake wallet that mimicked the genuine one with subtle differences that were not easily discernible to the unsuspecting investor.

The hapless individual failed to notice the discrepancies and transferred nearly all of their cryptocurrencies into a fraudulent digital wallet. Typically, users verify the initial and final digits of a wallet address for authenticity. However, the swindler meticulously crafted this address to ensure those specific characters aligned with legitimate ones.

The thief returned the stolen funds in the end, but transactions on the blockchain prior to the incident suggest that the attacker had planned something other than just taking the funds. Once in possession of the stolen WBTC (Wrapped Bitcoin), the hacker quickly exchanged it for approximately 23,000 ETH, a common practice among malefactors seeking to obscure the origin of their ill-gotten gains through privacy tools and crypto mixing services such as Tornado Cash.

Starting on May 8, I discovered an unwelcome intrusion into my crypto holdings. The malicious actor started moving my funds to over 400 different wallets, gradually spreading them out among more than 150 unique wallets before eventually returning some of the assets.

A fraudster, responsible for swindling approximately $71 million in wrapped Ethereum ($WBTC), has laundered the pilfered assets by dispersing around 23,000 Ethereum ($ETH) among numerous wallets.— PeckShieldAlert (@PeckShieldAlert) May 8, 2024

After the funds were restored, I, as an on-chain security analyst at SlowMist, released an analysis indicating that the culprit behind the $71 million heist, who might be residing in Hong Kong, grew apprehensive about potential repercussions. It is essential to note that this theft represents only a small fraction of the phishing attempts associated with the WBTC incident, as detailed in our May 10 incident report.

As a crypto investor following the latest developments regarding the 1155 WBTC phishing incident and the identified hacker, it appears that we’re on the brink of a significant shift in this situation.— SlowMist (@SlowMist_Team) May 9, 2024

As a crypto investor, I delved into examining the transaction history of this Ethereum address. Between April 19 and May 3, an unusual pattern emerged: over 20,000 smaller transactions were initiated, each distributing minuscule amounts of ETH to different addresses. My suspicion grew that these transactions might be part of a phishing scheme.

Read More

2024-05-13 17:08