Connect with us
DAPA Banner

Crypto World

Up just 0.2% on $36M loot

Published

on

Up just 0.2% on $36M loot

Since draining Japanese crypto platform UXLINK six months ago (and losing a chunk of the proceeds), the hacker behind the attack has been trying to hit it big on-chain.

It’s not going great.

Blockchain analytics platform Arkham has been tracking the hacker’s trading history, highlighting recent ETH sales which brought them back to breakeven.

But given the market over the past six months, one could argue that breakeven is nothing to be sniffed at.

Advertisement

Read more: UXLINK goes from bad, to worse, to weird after hacker loses stolen tokens

Advertisement

The September attack unfolded in two stages. First, UXLINK’s multi-signature wallet was compromised and drained for $11 million worth of assorted crypto tokens.

Hours later, the project’s token contract, which had also been compromised, minted a billion tokens, with a theoretical dollar value in the nine figures.

The drama didn’t stop there, however. While dumping the UXLINK tokens, and cratering its price as liquidity depleted, the hacker fell for a phishing link, losing half the freshly-minted tokens.

Trading with house money

Since then, the hacker’s trading history shows swaps made mainly between the stablecoin DAI and WETH or WBTC. 

Advertisement

Arkham’s profit and loss (PnL) calculations put the hacker’s cumulative PnL at $83,000 in the green. 

While the gains are small, just 0.2% of the $36.6 million held in the wallets, it’s currently performing better than at any time since the hack. 

PnL has been down-only, aside from brief periods of clawing back close to breakeven. But recent weeks have seen a sudden recovery from an all-time low of -$4.8 million in late February.

Read more: Venus Protocol hacker lost $4.7M after nine months of planning

Easy come, easy go

Hackers trading stolen funds have had mixed results in recent years.

Advertisement

Members of North Korea’s Lazarus Group traded the proceeds of 2024’s $50 million Radiant Capital attack, ending up $40 million in profit by last summer.

In October last year, a hacker who previously stole 400 bitcoins from a Coinbase user “panic sold” ether which they had bought with the ill-gotten gains.

During two crypto market crashes, a week apart, they realized a total of $10 million in losses.

Read more: Outdated algorithm caused $650M excess losses on Hyperliquid, report

A slightly more unsettling incident saw Lazarus-linked addresses liquidated for $500,000 on Hyperliquid in late 2024.

Advertisement

While some were happy to see the bad guys get wiped out, others were concerned the activity was testing for a potential future exploit.

Also on Hyperliquid, a wallet linked to the $30 million zKasino “rug pull” in April 2024 suffered a $27 million liquidation a year later.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on XBluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Electric Capital Maps 501 Real-World Yield Sources, Finds 93% Untouched by DeFi

Published

on

Electric Capital Maps 501 Real-World Yield Sources, Finds 93% Untouched by DeFi

A new taxonomy from the venture firm identifies seven barrier clusters keeping most traditional yield sources off-chain, and argues that stablecoin growth is pulling them closer.

Electric Capital published a research report on Monday, cataloging 501 distinct sources of real-world yield and cross-referencing them against tokenized assets with meaningful on-chain traction today.

The venture firm found that only 34 of those yield sources have any on-chain presence above $50 million, and they cluster in familiar territory: U.S. Treasuries, private credit, corporate bonds, and non-U.S. sovereign debt.

The remaining 93% fall into seven groups defined by what’s blocking tokenization, ranging from legal structuring challenges for asset-backed securities to real-world integration hurdles for commodities and compute infrastructure.

Advertisement

Distribution is the Bottleneck

Perhaps the report’s sharpest observation concerns distribution. Of 35 yield-bearing non-stablecoin RWAs above $50 million, only two have crossed 2,000 holders. While some of that is by design — BlackRock’s BUIDL requires a $5 million minimum — the data underscores how dependent most tokenized assets remain on a handful of large deployers and vault curators.

The report highlights how Centrifuge’s JAAA, a tokenized AAA CLO that held $743 million at the time of data collection, lost 44% of its value in a single day on March 9 after Sky’s Grove protocol redeemed $327 million in one transaction.

BlackRock’s BUIDL faces a similar dynamic: its top 10 holders control 98% of supply, and those holders are largely other protocols — Ethena, Ondo, and Sky.

What Comes Next

Electric Capital argues five compounding forces will pull new asset types on-chain: a growing stablecoin base with diversifying yield preferences, competition among protocols for differentiated products, vault infrastructure that absorbs duration risk, tranching layers that expand buyer bases, and leverage loops that multiply demand for collateral-eligible assets.

Advertisement

The firm also flagged AI infrastructure spending — projected by Goldman Sachs to exceed $500 billion in 2026 — as a catalyst, noting that GPU leasing, data center construction, and energy contracts are natural candidates for on-chain financing.

This article was written with the assistance of AI workflows. All our stories are curated, edited and fact-checked by a human.

Source link

Advertisement
Continue Reading

Crypto World

Google Threat Intelligence Sounds Alarm on Latest Crypto Malware Threat

Published

on

Malware, Cybercrime, Cybersecurity, Hacks

Google Threat Intelligence has identified a new form of crypto-stealing malware called “Ghostblade” that affects Apple iOS devices and is part of the “DarkSword” suite of browser-based malware tools designed to steal private keys and other sensitive information.

Ghostblade is written in JavaScript and designed for rapid data theft. The crypto-stealing malware activates, grabs sensitive data from the compromised device, and relays it to malicious servers, according to Google Threat Intelligence.

The Ghostblade malware does not run 24/7 on the compromised device, does not require extra plug-ins to function, and stops functioning after extracting data, making it more difficult to detect, the threat researchers said.

Malware, Cybercrime, Cybersecurity, Hacks
A timeline of the evolving malware threats targeting Apple iOS devices and the cybersecurity patches released to address the threats. Source: Google Threat Intelligence

The malware also includes code that deletes crash reports from the compromised device, preventing Apple from receiving them and flagging the malicious software.

Ghostblade can access and relay messaging data from the iMessage texting application for Apple devices, Telegram and WhatsApp.

Advertisement

The malicious software can also steal SIM card information, identity, multimedia and geolocation data, and access system settings, according to the Google cybersecurity report.

Malware, Cybercrime, Cybersecurity, Hacks
A list of sensitive data that can be stolen by Ghostblade malware. Source: Google Threat Intelligence

DarkSword and its components are one of the latest cybersecurity threats identified by Google Threat researchers, shedding light on the evolving methods used by malicious actors to steal crypto and other valuable data from unsuspecting users.

Related: Google uncovers iOS exploit kit used in crypto phishing attacks

Hacks fall in February as malicious actors pivot to exploiting human error

Losses from crypto hacks fell to $49 million in February, a sharp decrease from $385 million in January, according to blockchain intelligence platform Nominis.

This drop reflects a pivot from code-based cyber threats to crypto phishing attempts, wallet poisoning attacks and other threat vectors that take advantage of human error, Nominis said in its report.

Advertisement
Malware, Cybercrime, Cybersecurity, Hacks
Private users bore the brunt of hacking, phishing, and other crypto-theft attempts in February. Source: Nominis

Phishing attempts typically use fake websites designed to look legitimate. These fake websites often use URLs that are nearly identical to the legitimate sites they masquerade as, tricking users into visiting them.

These sites embed malware that can steal crypto private keys and other valuable data when a user accesses the site or clicks any of its elements. 

Magazine: WazirX hackers prepped 8 days before attack, swindlers fake fiat for USDT: Asia Express