Greetings!
A major and still unexplained hack happened this week. More than $238M were stolen from an address associated with Genesis Global Trading. Funds were quickly transferred to the usual suspects like Railgun, ChangeNow, eXch, Avalanche Bridge, ThorChain, and others. Railgun once again unshielded transfer of stolen funds, so may be attackers will learn to stop using it.
Seif Wallet exposed users’ private keys and passwords to a 3rd party analytics vendor. It’s not clear if any of the 50 exposed keys were actually drained; however, the incident is an interesting lesson in communicating the exposure to users:
According to Seif’s post-mortem, the bug was originally discovered on July 25th (thanks SEAL!) and patched on July 26th.
The announcement of the bug and exposed wallet on X went out on August 20th
No announcement on official Discord.
An earlier announcement on August 8th showed up buried deep in project’s docs.
Publishing such a critical exposure deep inside project’s docs and waiting to make a wider announcement almost a month later is what Web2 does. We can do better!
Parcl experienced simultaneous compromises of both their website and X accounts. In their post-mortem Parcl focuses a lot on the DNS hijacking but a double hack indicates a likely credentials theft from an insider.
To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.
Let’s dive into the news!
News
Zellic acquires Code4rena. The backstory on the acquisition.
Jaredfromsubway.eth is back with a new MEV bot and new sandwich attacks.
Crime
How long are prison sentences for crypto criminals in the US?.
Hackers linked to $14M Holograph crypto heist arrested in Italy.
Judge sets Oct 2025 trial for brothers allegedly behind $25M exploit. A federal judge has set the start date for the criminal trial of two brothers allegedly responsible for stealing $25 million in crypto by exploiting maximal extractable value (MEV) bots.
Binance founder CZ moved from prison to halfway house - isn’t free yet.
Binance Hit With Fresh Class Action Lawsuit Over Money Laundering Allegations.
Malaysian authorities destroy over 900 bitcoin mining rigs amid power theft crackdown.
Another suspected high-profile crypto scammer caught in Montenegro. Polish national Roman Ziemian, who is an alleged co-founder of crypto Ponzi scheme FutureNet, was originally arrested in Italy in 2022 but escaped while under house arrest.
Crypto scammer behind $4B fraud caught in Istanbul. Andreas Szakacs, the Swiss CEO of the cryptocurrency company OmegaPro, which began operations in 2019, was arrested in Turkey after obtaining Turkish citizenship.
Suspect in $14 billion cryptocurrency pyramid scheme extradited to China. A suspected ring leader was identified as Teow — full name Tedy Teow Wooi Huat — is also known as Zhang Yufa. He founded the MBI Group conglomerate in 2012.
CluCoin Founder Pleads Guilty to Stealing $1.1M of Investor Funds for Online Gambling.
Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse. Hanes was first targeted by scammers in late 2022, apparently when he got a message from an unidentified co-conspirator on WhatsApp, prosecutors said. After blowing through his personal, local church, a local investor club, and finally his daughter's college funds he started stealing bank funds—all in the false hopes that sending more and more money to the scammers would somehow "unlock the supposed returns" on his crypto investments.
SQ arrests suspect in kidnapping and death of Montreal cryptocurrency influencer. A 32-year-old woman was arrested Thursday as a suspect in the kidnapping and death of Kevin Mirshahi, a cryptocurrency influencer who was abducted from Old Montreal, along with three other people, earlier this summer.
Man Faces 20-Year Prison Sentence in Crypto Money Laundering Case. Villa, 61, served as a courier for a sophisticated criminal organization led by Jin Hua Zhang, based in Staten Island, New York.
Argentinian Authorities Arrest Russian National for Laundering the Crypto Proceeds of Illicit Activity. The subject accepted illicit cryptocurrency proceeds from illicit actors such as North Korea’s Lazarus Group, child sexual abuse vendors and terrorist financiers.
US Treasury Sanctions Nearly 400 Individuals and Entities For Supporting Russia’s War Machine.
Feds Will Contact Victims of Million-Dollar Crypto Scam 'via NFT’ After Founder's Guilty Plea.
Crypto scam: 99 arrested in Philippine raid on Chinese-run center - crypto.news.
99 Arrested in Philippine Crypto Scam Hub Raid. Among those arrested were three key figures: Nan Shan, the manager; Detu Su, the owner; and Wu Jian Bin, the supervisor. The raid also uncovered 64 foreign nationals, including Chinese, Malaysians, and others, alongside 32 Filipinos allegedly working as customer service representatives (CSRs) in the fraudulent operation.
Policy
Former SEC crypto enforcement chief David Hirsh leaves for private practice. He will be joining McGuireWoods law firm to help their clients “stay ahead of the curve”.
Phishing
Someone lost 211 ETH($553,312) by copying the wrong address from a contaminated transfer history.
Crypto trader loses $55M in DAI to phishing attack using Inferno Drainer kit. Whale Hunter's Payday by Rekt has additional details.
McRugged: Hackers Take Over McDonald’s Instagram, Make $700K on Fake Grimace Token.
Suspicious activity in GitHub associated with Lazarus Group by Heiner.
All of user’s wallets were drained by a fake job interview exercise.
Polygon Discord compromise hits Avalanche, ZKsync hours later.
Avalanche Discord server has been compromised. Only last week their COO’s X account was compromised as well.
Scams
Malware
A malicious Chrome extension called ‘Bull Checker’ drains Solana wallets.
New Malware PG_MEM Targets PostgreSQL Databases for Crypto Mining.
Infostealers Waltz Through macOS to Grab Crypto Wallets, Browser Creds.
Mac users beware: AMOS malware clones wallet apps and comes for your crypto.
Ransomware rakes in record-breaking $450 million in first half of 2024.
MoonPeak malware from North Korean actors unveils new details on attacker infrastructure.
Media
Contests
Solidity Challenges by Jason Schwarz (passandscore).
Bitmaps & Merkle Proofs - Damn Vulnerable DeFi V4 Primer by DegenShaker.
Research
Risk & Security Enhancement for App Chains: An In-depth Writeup of CWA-2023-004 by CertiK.
Demystifying and Detecting Cryptographic Defects in Ethereum Smart Contracts.
Settled, But Not Really: The Privacy Gap in Bitcoin's 'Final' Transactions.
Ecosystem Explorer - Exploring the Bitcoin L2 Saga and Recent Solutions.
Phrack 71 featuring our very own cts (Zellic).
Tools
LLEVM allows you to decompile and converse with evm bytecode, decompiled solidity, Yul and Opcodes by 0xKoda.
FOUR.MEME Sandwich Bot by Fuzzland recently used in a successful attack.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.
Premium Content
Keep reading with a 7-day free trial
Subscribe to Blockchain Threat Intelligence to keep reading this post and get 7 days of free access to the full post archives.