Twice on Friday, a payment landed on the hacker’s wallets carrying the message “Use https://swap.thorchain.ai and swap your funds, never return it to CZ,” once on the 437 $BTC address and once, in a longer version that added the hacker should never accept a whitehat deal, on the address that briefly held all 18,270 $BTC.
The link points to a page dressed up as a THORChain swap site. THORChain — the cross-chain swap network the attacker has already used to move the stolen funds — halted trading on 10 of its 13 chains over the weekend.
Meanwhile, some enterprising adults took the chance to market their products. A self-described Turkish crypto influencer attached a pitch for his own token, asking that “any donations you send will go toward developing the $NST token ecosystem.”
Early Saturday, someone wrote “Happy Hacklloween Satoshis for treats PLS.”
Despite the efforts, none of these messages have drawn a response, and the hacker’s bitcoin pile is growing instead. On Sunday, the attacker began swapping 970,522 stolen SOL, worth about $96 million, into bitcoin through the bridge Relay.
Leave a Reply