Poloniex crypto-exchange offers 5% cut to thieves if they return that $120M they nicked
(2023/11/10)
- Reference: 1699642273
- News link: https://www.theregister.co.uk/2023/11/10/justin_sun_poloniex_reward/
- Source link:
The founder of the Poloniex has offered to pay off thieves who drained an estimated $120 million of user funds from the cryptocurrency exchange in a raid on Friday.
Justin Sun, who also founded the Tron Foundation currency system, offered a so-called "white hat bounty" to those who siphoned the exchange's wallet dry, in return for the rest of the stolen funds being repaid. Otherwise the kid gloves come off.
"We are offering a five percent white hat bounty to the Poloniex hacker," Sun [1]wrote . "Please return the funds to the following ETH/TRX/BTC wallets. We will give you 7 days to consider this offer before we engage law enforcement."
[2]
That five percent bounty would worth up to $6.5 million, we reckon.
[3]Monero Project admits thieves stole 6-figure sum from a wallet in mystery breach
[4]South Korea cracks down on unlicensed foreign crypto businesses
[5]Two things will survive a nuclear holocaust: Cockroaches and crafty URLs like ғасеьоок.com
[6]Florida man jailed after draining $1M from victims in crypto SIM swap attacks
The founder made the announcement shortly after the exchange said it had disabled its wallet, citing "maintenance" as the reason. The outfit may have been able to stop some of the digital money, or more of it, from being stolen; it's not entirely clear.
"The Poloniex team has successfully identified and frozen a portion of the assets associated with the hacker's addresses," Sun alleged. "At present, the losses are within manageable limits, and Poloniex's operating revenue can cover these losses.
[7]
[8]
"Additionally, the team have restored Poloniex's systems, preserved relevant evidence, and in the coming days, we will work diligently to gradually resume deposits and withdrawals on Poloniex, ensuring 100 percent security. Apologize for any inconvenience this may have caused."
Blockchain security company SlowMist has compiled all of the data related to the attack on Poloniex into a publicly accessible [9]spreadsheet . At the time of writing, the attack had led to the theft of $130 million worth of cryptocurrency assets across hundreds of transactions.
[10]
Cyvers, another blockchain security company, was among the first to [11]alert the public to the woe at Poloniex at 1055 UTC on November 10, saying multiple suspicious withdrawals were made from the exchange's hot wallet. About an hour later, Sun confirmed the exchange was aware of the issues and was investigating.
According to SlowMist's data, the attacker drained myriad types of tokens. Scans of the [12]Ethereum and Sun-owned [13]Tron blockchains revealed a wallet titled "Poloniex hacker" is offloading the assets en masse in exchange for Ethereum and Tron tokens.
PeckShield [14]broke down the losses by individual blockchains:
Ethereum – $56 million
Tron – $48 million
Bitcoin – $18 million
Poloniex's incident is the latest in a long line of high-profile wallet-draining attacks in the blockchain community.
The Monero Project announced last week that one of its wallets reserved for community crowdfunding initiatives was drained of XMR worth more than $400,000.
[15]
A sub-group of North Korea's state-sponsored Lazarus offensive cyber operation, tracked as "BlueNoroff" is believed to be [16]behind at least some of the attacks that have been ongoing since April.
Speaking to The Register , cybersecurity expert Dominic Alvieri said that although key facts are yet to be established, the attack on Poloniex appears to share the same MO as Lazarus' previous work.
As for how the Monero Project was drained, the lead maintainers are still without answers. Industry experts pointed to [17]LastPass's 2022 breach as a possible method of stealing wallet seeds, an idea that LastPass has refuted. ®
Get our [18]Tech Resources
[1] https://twitter.com/justinsuntron/status/1722951876986204259
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2023/11/08/monero_project_developers_announce_breach/
[4] https://www.theregister.com/2022/08/18/south_korea_cracks_down_on/
[5] https://www.theregister.com/2018/01/19/idns_phishing_domains/
[6] https://www.theregister.com/2023/10/30/sim_swapping_crypto_crook_jailed/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://docs.google.com/spreadsheets/d/1PdBEjgiPK4rckX85jlwTzpLs51d1bK0HO0S1oMzro4c/edit#gid=0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://twitter.com/CyversAlerts/status/1722937212071735665
[12] https://etherscan.io/tokentxns?a=0x0a5984f86200415894821bfefc1c1de036dbf9e7
[13] https://tronscan.org/#/address/TKK6d1YALy8HCSoCSWWd1ZJhyC9NPPx4wa/transfers
[14] https://twitter.com/peckshield/status/1722991018272759816
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2023/06/08/lazarus_link_atomic_wallet/
[17] https://www.theregister.com/2022/12/23/lastpass_attack_update/
[18] https://whitepapers.theregister.com/
Justin Sun, who also founded the Tron Foundation currency system, offered a so-called "white hat bounty" to those who siphoned the exchange's wallet dry, in return for the rest of the stolen funds being repaid. Otherwise the kid gloves come off.
"We are offering a five percent white hat bounty to the Poloniex hacker," Sun [1]wrote . "Please return the funds to the following ETH/TRX/BTC wallets. We will give you 7 days to consider this offer before we engage law enforcement."
[2]
That five percent bounty would worth up to $6.5 million, we reckon.
[3]Monero Project admits thieves stole 6-figure sum from a wallet in mystery breach
[4]South Korea cracks down on unlicensed foreign crypto businesses
[5]Two things will survive a nuclear holocaust: Cockroaches and crafty URLs like ғасеьоок.com
[6]Florida man jailed after draining $1M from victims in crypto SIM swap attacks
The founder made the announcement shortly after the exchange said it had disabled its wallet, citing "maintenance" as the reason. The outfit may have been able to stop some of the digital money, or more of it, from being stolen; it's not entirely clear.
"The Poloniex team has successfully identified and frozen a portion of the assets associated with the hacker's addresses," Sun alleged. "At present, the losses are within manageable limits, and Poloniex's operating revenue can cover these losses.
[7]
[8]
"Additionally, the team have restored Poloniex's systems, preserved relevant evidence, and in the coming days, we will work diligently to gradually resume deposits and withdrawals on Poloniex, ensuring 100 percent security. Apologize for any inconvenience this may have caused."
Blockchain security company SlowMist has compiled all of the data related to the attack on Poloniex into a publicly accessible [9]spreadsheet . At the time of writing, the attack had led to the theft of $130 million worth of cryptocurrency assets across hundreds of transactions.
[10]
Cyvers, another blockchain security company, was among the first to [11]alert the public to the woe at Poloniex at 1055 UTC on November 10, saying multiple suspicious withdrawals were made from the exchange's hot wallet. About an hour later, Sun confirmed the exchange was aware of the issues and was investigating.
According to SlowMist's data, the attacker drained myriad types of tokens. Scans of the [12]Ethereum and Sun-owned [13]Tron blockchains revealed a wallet titled "Poloniex hacker" is offloading the assets en masse in exchange for Ethereum and Tron tokens.
PeckShield [14]broke down the losses by individual blockchains:
Ethereum – $56 million
Tron – $48 million
Bitcoin – $18 million
Poloniex's incident is the latest in a long line of high-profile wallet-draining attacks in the blockchain community.
The Monero Project announced last week that one of its wallets reserved for community crowdfunding initiatives was drained of XMR worth more than $400,000.
[15]
A sub-group of North Korea's state-sponsored Lazarus offensive cyber operation, tracked as "BlueNoroff" is believed to be [16]behind at least some of the attacks that have been ongoing since April.
Speaking to The Register , cybersecurity expert Dominic Alvieri said that although key facts are yet to be established, the attack on Poloniex appears to share the same MO as Lazarus' previous work.
As for how the Monero Project was drained, the lead maintainers are still without answers. Industry experts pointed to [17]LastPass's 2022 breach as a possible method of stealing wallet seeds, an idea that LastPass has refuted. ®
Get our [18]Tech Resources
[1] https://twitter.com/justinsuntron/status/1722951876986204259
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2023/11/08/monero_project_developers_announce_breach/
[4] https://www.theregister.com/2022/08/18/south_korea_cracks_down_on/
[5] https://www.theregister.com/2018/01/19/idns_phishing_domains/
[6] https://www.theregister.com/2023/10/30/sim_swapping_crypto_crook_jailed/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://docs.google.com/spreadsheets/d/1PdBEjgiPK4rckX85jlwTzpLs51d1bK0HO0S1oMzro4c/edit#gid=0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://twitter.com/CyversAlerts/status/1722937212071735665
[12] https://etherscan.io/tokentxns?a=0x0a5984f86200415894821bfefc1c1de036dbf9e7
[13] https://tronscan.org/#/address/TKK6d1YALy8HCSoCSWWd1ZJhyC9NPPx4wa/transfers
[14] https://twitter.com/peckshield/status/1722991018272759816
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZU62GBOaUnSEMiDpr7xFDwAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2023/06/08/lazarus_link_atomic_wallet/
[17] https://www.theregister.com/2022/12/23/lastpass_attack_update/
[18] https://whitepapers.theregister.com/
Re: Hold on!
DS999
Wasn't block chain the ultimately secure solution to every problem in the world?
Funny how the traditional banking system is actually the secure one when it comes to electronic theft, because if hackers hack into a bank and electronically transfer $120 million they'd never see it as the transfer would simply be reversed.
So I guess blockchain is the secure option for criminals due to the impossibility of reversing such a transfer meaning the only alternative is to bribe them!
High Street Bank offers 5% cut to thieves if they return that $120M they nicked
Howard Sway
And if they don't bring the cash back within a week .... they'll call the police!
Nope, still not seen that headline, but this is at least the 4th big straight up crypto theft like this so far this month (not counting scams and fraud, which are also numerous).
Crypto and scamming; a marriage made in heaven
druck
We will give you 7 days to consider this offer before we engage law enforcement."
Even if they went the whole hog and married the police, they wouldn't be interested in the whole mess of pretend money thefts.
Hold on!
Wasn't block chain the ultimately secure solution to every problem in the world? And now paying a ransom to criminals is a "white hat bounty"?