DeFi
The $7.4 million stolen by Hundred Finance last year is starting to move – DL News
- Hundred Finance hacker converts stolen funds into Ether.
- The hacker could be preparing to cash in some of his loot.
In April last year, a hacker exploited a bug in the Optimism-based DeFi protocol Hundred Finance, earning $7.4 million.
After more than a year of silence, the stolen funds are now in circulation.
Wednesday around 10:25 a.m. London time, the hacker withdrew nearly $800,000 worth of Ether and Tether’s USDT stablecoin from decentralized exchange Curve after using the tokens to provide liquidity there over a year ago.
After the withdrawal, the hacker used the decentralized exchange Uniswap to exchange USDT, as well as smaller amounts of other cryptocurrencies like PAXG, WOO, FRAX, and DAI into Ether.
In total, the transactions increased the wallet’s Ether holdings by just over $1 million.
The hacker now holds $4.2 million worth of Ether, $1.2 million worth of DAI, $859,000 worth of Synthetix sUSD stablecoin, and smaller amounts of Wrapped Ether, FRAX, SNX, and Wrapped Bitcoin.
It’s unclear why the hacker suddenly decided to start transferring funds after all this time. If the hacker still controls the wallet and is behind the transactions, this could indicate that they are preparing to cash out the stolen funds.
Hackers often convert stolen cryptocurrencies into Bitcoin or Ether in order to more easily exchange them for fiat currency.
Join the community to receive our latest stories and updates
Could the hacker cash out?
It may become increasingly difficult for the hacker to cash out their stolen crypto.
Before attempting to cash out funds through a centralized crypto exchange, the hacker will need to break the chain of custody that links the funds to the wallet that carried out the hack.
Previously, hackers relied on crypto mixers like Samourai Wallet or privacy protocols like Tornado Cash to launder funds.
But regulators around the world are cracking down on the ways crypto users can obscure their transaction histories.
On April 24, the European Parliament voted in favor ban crypto mixers under the new anti-money laundering regulations.
Then on April 25, the DoJ accused two founders of crypto mixer Samourai Wallet with conspiracy to commit money laundering and conspiracy to operate an unlicensed money transmitting business.
In the case of Samourai Wallet, US authorities took control of the crypto mixer’s servers, leaving it unusable.
The enforcement measures also dissuaded users from using crypto mixers and privacy protocols. In September 2022, the developers of the Tornado Cash privacy protocol said According to crypto security company Elliptic, the protocol’s low liquidity meant users struggled to mix even $100.
The Hundred Finance hack: one year later
Hundred Finance was a protocol derived from the popular lending protocol Compound v2 that allowed users to lend and borrow cryptocurrencies.
On April 15, 2023, a hacker exploited a bug in Hundred Finance’s code to steal approximately $7.4 million from depositors.
Hudrend Finance once held over $300 million in assets.
The pirate exploited a rounding error in the way the protocol handled withdrawals, allowing them to use a small amount of Wrapped Bitcoin as collateral to withdraw more assets than they should have been able to.
Following this exploit, Hundred Finance initially offered an open bounty of $500,000 for information that could lead to the hacker’s arrest and recovery of the stolen assets.
The protocol later attempted to negotiate the return of the funds by offering the hacker 10% of the stolen funds, or approximately $740,000, in exchange for the safe return of the remaining 90%.
Both attempts to recover the stolen funds failed and Hundred Finance token holders vote to stop the project on August 9.
Tim Craig is a DeFi correspondent at DL News. Do you have any advice? Send him an email to tim@dlnews.com.