The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert and asked THORChain node operators, decentralized finance services and other crypto businesses to block transactions involving the group’s addresses or funds derived from them.
The conversions make it harder to freeze stolen funds. Stablecoin issuers can freeze tokens such as USDT and $USDC, and have frozen more than $3 billion stolen from Binance, but bitcoin and ether have no issuer able to freeze wallet balances.
THORChain provides a way to exchange assets across blockchains without opening an account at a centralized exchange. The hackers behind the Binance breach have shown signs of automated transfer, with an analysis from Elliptic finding repeated swap amounts going into THORChain, while a distribution wallet on Tron sent funds hourly for more than a day. Recipient wallets typically forwarded funds within about two minutes.
SomaXBT counted 2,697 deposits into THORChain in the Nov. 1 snapshot, and interfaces used to submit the swaps earned an estimated $95,000 in affiliate fees, the investigator said.
THORChain’s operations were interrupted on Oct. 31 when an Ethereum block reorganization, which replaces a recently added block, exposed a refund fault. The network paid out 10 ETH that a vault had not received, triggering a trading halt, which Chainalysis said also delayed laundering of the stolen funds.
Leave a Reply