ZachXBT Investigation Reveals $14.8M Exploit On Crypto Exchange Rain

As an experienced analyst in the cryptocurrency industry, I find it deeply concerning to witness yet another significant security breach, this time at Bahrain-based crypto exchange Rain. With the staggering loss of approximately $14.8 million, it’s clear that sophisticated hackers have once again targeted a vulnerable exchange.


Recent reports from on-chain investigator ZachXBT suggest that Rain, the crypto exchange based in Bahrain, has suffered a major security incident.

Details of Exploit

As an analyst, I uncovered a significant incident on April 29, 2024, where approximately $14.8 million was siphoned away. During ZachXBT’s investigation, we identified unusual transactions from Rain’s BTC, ETH, SOL, and XRP wallets on that very day. The funds were rapidly transferred to instant exchanges and converted into BTC and ETH. Since then, the stolen funds have been stored in two wallets: one with 137.9 BTC and another with 1,881 ETH. Neither of these wallets has shown any activity since the exploit.

Post-Exploit Transactions

The wallet address ending in d609 on Ethereum was identified through further examination as the recipient of numerous transactions from Bitgo multisignature wallets. These transactions, consisting of 26 individual transfers, involved the transfer of ETH and various tokens such as Shiba Inu, Chainlink, Tether, and USD Coin. Immediately following these transfers, the received tokens were exchanged for ETH on Uniswap.

Following the preliminary intrusion, Arkham Intelligence noted that the d609 wallet began collecting various tokens including Aave, Yearn Finance, and MakerDAO. Subsequently, these tokens were converted into Ethereum, demonstrating the intricate means hackers use to conceal their actions.

Industry-Wide Impact

According to Rain’s official announcement on their website, the sophisticated trading platform of their “pro” version has encountered occasional disruptions since May 5. In the year 2023, Rain secured authorization to conduct virtual asset brokerage and custody services in the United Arab Emirates.

The Rain heist is yet another instance in the rising number of cyberattacks targeting cryptocurrencies. Last year, such incidents resulted in a devastating loss of approximately $2 billion for crypto investors. Furthermore, an extra $333 million was taken in the opening quarter of this year.

Similar Recent Incidents

Rain’s security incident comes on the heels of other similar occurrences within the cryptocurrency sector. On May 6th, the Discord platform used by the Gnus AI community was infiltrated, leading to a financial loss of approximately $1.27 million. The intruders managed to access private messages among team members and fabricated 100 million counterfeit tokens, resulting in a dramatic drop in value for the GNUS token.

As a crypto investor, I’ve unfortunately experienced a setback with Galaxy Fox’s web3 platform. On May 10, the platform fell victim to a smart contract vulnerability, leading to the unfortunate theft of more than 108 Ether from its users, including myself.

On May 10, the Tsuru platform experienced troubles with its TRUSU Wrapper contract. This glitch caused considerable difficulties in processing transactions. Maliciously exploiting this weakness, users were able to circumvent standard contract functions using custom code, resulting in “out-of-gas” errors and disrupted transaction workflows.

The string of hacking incidents has brought a cloud of uncertainty over the cryptocurrency sector, which is further hampered by intricate regulatory measures imposed by the SEC and other regulatory bodies.

Read More

2024-05-14 17:02