A Threat Actor Withdraw $45.96 Million in BTC After AVAX Deposits

ZachXBT a private investigator analyst revealed a series of coordinated attacks, potentially orchestrated by a single threat actor, leading to $45.96 Million BTC withdrawals made shortly after the AVAX deposits at both Coinbase and Binance.

The timeline of events paints a clear picture of a well-executed heist. A highly suspicious activity involving the movement of massive sums of AVAX and BTC has drawn the attention of security analysts and crypto enthusiasts alike. The data points to a coordinated operation with remarkable precision:

AVAX Deposits and BTC Withdrawal Suspicion

An anonymous entity, identified as 0x327a81d0d128db8886d265be73c9fdda97194f30, began transferring a significant amount of AVAX  1.96M ($54.2M) to prominent exchanges like Coinbase, Binance, and Gate.io.

A part of these funds was acquired through THORChain, which is a decentralized network facilitating cross-chain asset transfers. Following the AVAX deposits, a significant amount of BTC was withdrawn from both Coinbase and Binance.

Coinbase saw the departure of 587.75 BTC ($38.1M) to the address bc1q7pkc7h8td55s4em7tmlvd42wahjd4hm8lf035n, while Binance witnessed the outflow of 122.66 BTC ($7.95M) to bc1qezradgkklz3gczk9jjzn922ye7pgj4yd9pnupv.

Further investigation revealed a striking correlation between these transactions and the BTCTurk hack. The sequence of these occurrences indicates that the AVAX deposits and BTC withdrawals were a deliberate part of a broader scheme to exploit vulnerabilities within BTCTurk.

Two hours before the BTCTurk hack, Sportsbet, a popular online casino, became another victim of the same threat actor. Sportsbet suffer a $3.5M loss linked to the addresses TDgZKxhyFQWCsNK1p7d1tVifeuW2DJTUEo, TQWSmSqns2BLczLEMpy96tNq3MagM66H4b, and TJZ8NNxJETGDzGaWwSHwjGrzzz2Zhvexo2.

Conclusively, this undeniable connection suggests a coordinated and multi-pronged attack aimed at extracting maximum profit from vulnerable platforms.

DFX Finance Hacked, Warns Polygon LP Holders to Withdraw Funds

Digital Futures Exchange Finance, also known as DFX Finance, reported a cyberattack in which they lost crypto tokens worth $7.5 million. The project confirmed the cyberattack on Twitter, noting suspicious activities in DFX contracts on Thursday. They paused all DFX contracts after confirming the cyberattack, which they did by identifying the hacker’s first suspicious transaction.

DFX Finance traced the stolen funds and the hacker’s address. They observed the hacker converting the stolen funds to Ethereum (ETH) and transferring them to Tornado Cash. When the attacker failed to convert New Zealand Dollar Stablecoin (NZDS) to Ethereum, the stolen funds were bridged to Polygon.