Overview of the Incident
On October 9, alarming figures began to surface as independent analysts traced suspicious transactions linked to CryptoBilis clients. Initial evaluations indicated that over $72 million could have been lost, but this number quickly escalated to more than $86 million as further addresses were examined. A thorough inquiry by Bitquery later determined that the total losses might actually reach as high as $93.2 million, encompassing several cryptocurrencies including Tron, Bitcoin, Ethereum, Solana, Binance Smart Chain, and Polygon.
Breakdown of Losses
The breakdown of these losses was particularly striking, with Tron suffering the most significant hit at roughly $70.5 million. Bitcoin followed with losses around $16.8 million, while Ethereum was reported at $3.7 million. Researchers focused on tracking how much cryptocurrency left the compromised wallets, intentionally avoiding issues of double counting that could arise from tracing transactions among those who may control the stolen funds.
Coordinated Efforts and Security Concerns
Bitquery’s analysis revealed unusual activity hinting at a coordinated effort to drain wallets. For instance, it was noted that 25 separate wallets on the Tron network executed the same request within just three seconds. Additionally, investigators observed a series of smaller test transactions over a two-week period prior to the significant theft on October 9.
This incident sheds light on ongoing worries regarding the security of hardware wallets, with victims unable to ascertain how attackers might have accessed their private keys purely from blockchain records. Also noteworthy is the tracing of 2,990 ETH through anonymizing services like Tornado Cash and Zcash, showcasing how ill-gotten assets can navigate through privacy-centric systems. Such movements have previously complicated efforts to investigate other hardware wallet breaches involving Bitcoin.
Response to the Crisis
In response to the crisis, Tether took action by freezing around $10 million worth of USDT, across twenty separate wallets. This response underscores the capacity of centralized issuers to freeze stablecoin assets, though it’s crucial to note that merely freezing funds does not guarantee their recovery for the victims of this latest incident.
