Is the same hacker attacking Nexus Mutual, EasyFi and FinNexus?

May 26, 2021

After analyzing the on-chain transfer records of Nexus Mutual, EasyFi and FinNexus hackers, we found some clues.

Written by: Pastebin user CRDT

As we all know, on December 14, 2020, an unknown hacker stole 370,000 NXM from the wallet of the CEO of Nexus Mutual DeFi. On April 20, 2021, another hacker attack occurred, but this time another project called EasyFi DeFi was attacked. In this hacking attack, the hackers stole nearly three million EASY tokens.

On May 17, 2021, the system of the FinNexus DeFi project was attacked by hackers. The hacker was able to mint 323 million FNX tokens and sell them on the open market. All the above three hacking attacks have a similar characteristic. Hackers aim to gain access to wallets or private keys, and then be able to obtain funds. And the same is that these hacking attacks were carried out in the same hour.

All the survey results we publish in this article are from our own independent surveys, and these survey results may differ from official survey results.

From media reports, we learned about the ETH wallet addresses belonging to hackers who attacked Nexus Mutual, EasyFi, and FinNexus. Now look at each address of all these hackers separately.

Start in order. The first hacking attack we discussed was an attack on Nexus Mutual, which occurred in December 2020. The Etherscan block explorer showed that multiple addresses belonged to the hacker. But let’s focus on one of the addresses first, and Etherscan labeled it Fake_Phishing4636.

The leading number of the hacker’s address is
0x0adab45946372c2be1b94eead4b385210a8ebf0b.
ETH address
0x0adab45946372c2be1b94eead4b385210a8ebf0b and
0x31499E03303dd75851a1738E88972CD998337403
(You need to remember this address) A direct transaction was made .

The second address we observed is the hacker address in the EasyFi attack. This address is not tagged in Etherscan. But according to media reports, we learned that this address
0x83a2EB63B6Cc296529468Afa85DbDe4A469d8B37.

The hacker’s wallet was found to have received a transfer deposit from the known address 0x31499E03303dd75851a1738E88972CD998337403.

At the same time, the EasyFi hacker’s address also had a direct transaction with 0x31499E03303dd75851a1738E88972CD998337403, which was the last transfer-out transaction made by the EasyFi hacker.

In addition, EasyFi hackers have performed multiple direct transactions from the address 0x77BEB16e4DB0686e36dbf01142685275785775Ed.

https://etherscan.io/tx/0xcf99a55af6ee7a3d46f121fe091d2e29720881a72b5876dac25068fb73405ec5
https://etherscan.io/tx/0xb189754f07f00f3e32fbfd3e60f34686afd5209c7ccfe281c7ee5ad5ba514270

There are also these transactions:

https://etherscan.io/tx/0x4d6d6c5d6231614db587b52d1f8e4d58c8b804032f5ee959344ac47c51b046e6
https://etherscan.io/tx/0x8ecd760060c60cb64520d803774a08c83210aac06a0ebbfcb436a5ffdc7348f5
https://etherscan.io/tx/0xd843d0b9300b1cdc79c0e1280127163794c7df6c87dca06cb128b232779f0291

address
0x77BEB16e4DB0686e36dbf01142685275785775Ed
Also based on address
0x31499E03303dd75851a1738E88972CD998337403

https://etherscan.io/tx/0x7d90cbac9ff954555ee9e927598ff5daee9c3396451262fa77c44fab6bda25c0

As far as we know, unlike the Nexus Mutual hacker address, the EasyFi hacker’s address and the address 0x31499E03303dd75851a1738E88972CD998337403 are not a direct transaction, but multiple transactions. Please remember the address 0x31499E03303dd75851a1738E88972CD998337403, because we will encounter this address many times later.

Now look at the address of the FinNexus hacker. According to media reports, the address is 0x5EbC7d1Ff1687A75f76c3EdFAbCdE89D1C09Cd5F, which is tagged in the block explorer Etherscan. We did not observe a direct interaction between the address 0x5EbC7d1Ff1687A75f76c3EdFAbCdE89D1C09Cd5F and the address 0x31499E03303dd75851a1738E88972CD998337403.

But there is an indirect interaction through the address 0x2Da3a8738c34fFB35182670bcb76Ad722240bcC0. Despite the fact that the hacker deliberately concealed the address 0x31499E03303dd75851a1738E88972CD998337403, we were still able to discover this association. The FinNexus hacker’s main address had a direct transaction with the address 0x2Da3a8738c34fFB35182670bcb76Ad722240bcC0.

This address and address
0x1cE5f1fe7d8543A0046E521302C3A21734309302
There are two FNX token transfer and outbound transactions.

https://etherscan.io/tx/0x0403a2a195c94203ccc36c3a481328b478742bbb390e7ab7debbc44de534abcd
https://etherscan.io/tx/0x84aaa19f5b8bb5ac58047eac0d462bdf9f7631a4d7a2a9c911718dfc35845584

Next, the address
0x1cE5f1fe7d8543A0046E521302C3A21734309302
With address
0x67fe5B5343f963C7043cE551FADBa84a3aD6473A
There are multiple transactions:

https://etherscan.io/tx/0xdc54b9fc18773e04365710ca3f243c47e196218f1855d5d177ec45598c1a838c
https://etherscan.io/tx/0x0403ec450fd3fd3ef1915cbcf0e5a3e3c679b81188399ac09bb7c3bf8ef21f2e
https://etherscan.io/tx/0xffe4d170dd4461a173acaa694dc9220755f0bfcba0883723ef843e7b4569de8d
https://etherscan.io/tx/0x968bd9ead37db5d7c7148ac5c0bd6860032a952f517d180713efeaf8dfd6971f
https://etherscan.io/tx/0x7ef4693769adb3f1ee362ae0c77e695c7fb94ac291da736efd28aee554f7f3f3

There are a total of 12 transactions between the two.

In addition, the address
0x67fe5B5343f963C7043cE551FADBa84a3aD6473A
Received a Tornado Cash deposit .

Exactly the address
0xA29bD5815AEA7ac88E9F3AaDd8F477675EDAD404
Slave address
0x67fe5B5343f963C7043cE551FADBa84a3aD6473A
The number of transfers made is approximately equivalent to 1 ETH.

0xA29bD5815AEA7ac88E9F3AaDd8F477675EDAD404 address is deposited in Tornado Cash in the transaction :

Next, the address 0xA29bD5815AEA7ac88E9F3AaDd8F477675EDAD404 makes a transaction based on the address 0x31499E03303dd75851a1738E88972CD998337403.

You can also see a lot of direct transactions
(28 transactions in total) and
https://etherscan.io/tx/0x61324b4a3624eccf5c69e7fb4292f3f22ccf295d07dbf866679a6c38ce2df0bf .

address
0x67fe5B5343f963C7043cE551FADBa84a3aD6473A
There is a transfer of 124,977.5383 USDT tokens to the address
0x860Dc1b24f96F59F4ec25ca439bcB9cDD6c1a7B0:

address
0x860Dc1b24f96F59F4ec25ca439bcB9cDD6c1a7B0
With known address
0x31499E03303dd75851a1738E88972CD998337403
There is a connection, its last transaction

Similar, address
0x860Dc1b24f96F59F4ec25ca439bcB9cDD6c1a7B0
Also with address
0x31499E03303dd75851a1738E88972CD998337403
Use the same intermediate wallet
0x67fe5B5343f963C7043cE551FADBa84a3aD6473A
A connection occurred.

So I want to talk about the address
0x5EbC7d1Ff1687A75f76c3EdFAbCdE89D1C09Cd5F
This address belongs to the hacker in the FinNexus attack. This address looks like a normal wallet in Etherscan, but in block explorers such as Bloxy and Bitquery, the contract
0x5EbC7d1Ff1687A75f76c3EdFAbCdE89D1C09Cd5F
Is by address
0x78d147015a9ef3ed9f9011fa394561670dc787cb
Created by the following transaction .

Therefore, the hacker attacks encountered by the Nexus Mutual, EasyFi and FinNexus projects are not only related to the nature of the attack, but also to the same address
0x31499E03303dd75851a1738E88972CD998337403
All have a connection. This shows that the above-mentioned hacking attacks were all carried out by the same hacker (or the same group of hackers).

Let’s try to dig a known address
0x31499E03303dd75851a1738E88972CD998337403
The old bottom. First find and own this address
0x31499E03303dd75851a1738E88972CD998337403
That person.

address
0x31499E03303dd75851a1738E88972CD998337403
With address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
There are many interactive transactions:

Involving 9 direct transactions of different tokens, as can be seen from the link :

address
0x31499E03303dd75851a1738E88972CD998337403
With address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
The number of direct interactive transactions between the two addresses is: 18 transactions (!!!).

Next, the address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
Slave address
0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
Receive the first deposit .

address
0x834e6bedc304c4c610557e9ffaf0d4ec310b881b
Is by address
0x0AAf72DA643570Da1bF76E8b3063C3f378b3D3D4
Created in this transaction .

address
0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
With address
0x0AAf72DA643570Da1bF76E8b3063C3f378b3D3D4
There are multiple transactions:

And 21 direct token exchange transactions .

address
0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
And address
0x0AAf72DA643570Da1bF76E8b3063C3f378b3D3D4
The total number of interactive transactions between them reached 35 (!!!).

address
0x0AAf72DA643570Da1bF76E8b3063C3f378b3D3D4
Belongs to Anton Dziatkovskii. Anton Dziatkovskii publicly stated in the following social media channels that he has
0x0AAf72DA643570Da1bF76E8b3063C3f378b3D3D4
This address:

Speaking of Anton Dziatkovskii, we know that he is a developer of the DeFi project platform, a developer of smart contracts, an expert in the field of smart contract security, he is a computer expert, a self-styled white hat hacker, a cryptocurrency trader, and has served many The project’s security vulnerabilities are rewarded to the enterprise managers.

Meanwhile, Anton Dziatkovskii also MicroMoney co-founder of the project, UBAI director of education programs. One of the products developed by UBAI is the BTCNext exchange . Anton Dziatkovskii is also the co-founder of the QDAO DeFi project. Anton Dziatkovskii is also a member of the NoahCity project team. Anton Dziatkovskii is the founder of the Platinum Fund project team, which develops DeFi projects and blockchain solutions platforms. Anton Dziatkovskii is directly related to the development of the SpaceSwap DeFi project and its possible co-founders. Anton Dziatkovskii is the bounty program manager of the SpaceSwap project. His bitcointalk username Cubus’s personal information may have seen the above information in a fraud dispute .

Now talk about Anton Dziatkovskii’s profile (link):

address
0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
With address
0x4664db097caC5E006AC94705D3C778f2aC896AA8
There is a direct transaction:

There are also 15 token transactions. address
0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
And address
0x4664db097caC5E006AC94705D3C778f2aC896AA8
The number of direct transactions between them reached 28 (!!!).

In addition, several related transactions used intermediate addresses
0xDaEB3B152bE7ac786E79122C4655594e7808587D.

address
0x4664db097caC5E006AC94705D3C778f2aC896AA8
With the address of Anton Dziatkovskii
0x0aaf72da643570da1bf76e8b3063c3f378b3d3d4
Related:

https://etherscan.io/tx/0xc75a093e8da8232cda46e64a244d08ea77ef53e3cfd3879c851f24acdef8a06e
https://etherscan.io/tx/0xff9211c8a521f000d9e9f96bf78c5f1630892a7c42f8858aa779dfde9deb54c1
https://etherscan.io/tx/0x9a204b1f662e00747961b31ad6ba858d1b38fbc31f1f8c4cc56e3359d9ca8a86
https://etherscan.io/tx/0x6d4194f76b4dbeac399be2a096684ad4e1347e3928cfb674c339cbc186391d1e
https://etherscan.io/tx/0xba9a9807e2969d5f0d9296426492a38cdcd4e4b8071c64e7d453f7c63b32f4cd

address
0x4664db097caC5E006AC94705D3C778f2aC896AA8
With address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
There is an association with the address
0x31499E03303dd75851a1738E88972CD998337403
There are many transactions, including at least two transactions:

https://etherscan.io/tx/0xa6e43e8d7ee9455ebc5291a031548a346fcf4176df41f4201ded66436ab9b115
https://etherscan.io/tx/0xadc4495b302dcb747c7f1db98d79f588ce42ec88369bd653fbfe9e790fdcaaa1

All this means the address of the hacker
0x31499E03303dd75851a1738E88972CD998337403
With address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
There are many interactive transactions, so the two links are at the address
0x0aaf72da643570da1bf76e8b3063c3f378b3d3d4
There is a crossover, and this address belongs to Anton Dziatkovskii:

The first link: at the intermediate address
With the help of 0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
(Lay the foundation for address 0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912);

The second link is through the intermediate address 0x4664db097caC5E006AC94705D3C778f2aC896AA8.

address
0x4664db097caC5E006AC94705D3C778f2aC896AA8
With address
0x5a6a52a7bf22813882e988135a7d2be805bb0649
The association has been generated through numerous transactions:

There are also 58 transactions .

A total of 69 transactions (!!!).

address
0x5a6a52a7bf22813882e988135a7d2be805bb0649
Is the cornerstone , the address is constructed
0x71e0d074bb70fdc5345f986e3435117f52afcebb.

The creator of the smart contract of the QDAO token issued by the QDAO DeFi project, and Anton Dziatkovskii is the co-founder of the project:

https://etherscan.io/address/0x3166c570935a7d8554c8f4ea792ff965d2efe1f2

address
0x71e0d074bb70fdc5345f986e3435117f52afcebb
It is the creator of the smart contract of the BNX token. The token belongs to the BTCNext exchange, which belongs to the UBAI project, and Anton Dziatkovskii is also its co-founder.

address
0x71e0d074bb70fdc5345f986e3435117f52afcebb
Also with address
0x4664db097caC5E006AC94705D3C778f2aC896AA8 has conducted joint transactions many times.

address
0x5a6a52a7bf22813882e988135a7d2be805bb0649
Also with address
0x81cfe8efdb6c7b7218ddd5f6bda3aa4cd1554fd2
There have been several direct transactions:

https://etherscan.io/tx/0xd016bd35a947a95af6505db3f426b53d9429f21705cd340f29cf96d6bb7d478a
https://etherscan.io/tx/0xf7adf5ff89bb7a00bbaf7dbc81bf8a889f01139766f45756f22615a3bebbbadf

And transactions with multiple tokens, and the use of intermediate addresses
0x3c586d0e07f312a180ec46d4c27d831731c41d23
A number of transactions have been made.

address
0x81cfe8efdb6c7b7218ddd5f6bda3aa4cd1554fd2
Also with address
0x4664db097caC5E006AC94705D3C778f2aC896AA8
Joined many times.

Address only
0x81cfe8efdb6c7b7218ddd5f6bda3aa4cd1554fd2
With address
0x834e6BEdC304C4C610557e9fFAf0D4Ec310b881B
There was a direct transaction, and it was this address that created the address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912,
The addresses involved in the above hacking incidents
0x31499E03303dd75851a1738E88972CD998337403
There have been many transactions .

The transaction also used the intermediate address 0x3c586d0e07f312a180ec46d4c27d831731c41d23.

address
0x81cfe8efdb6c7b7218ddd5f6bda3aa4cd1554fd2
It is the creator of the MILK2 token and the SHAKE token smart contract. The latter belongs to the SpaceSwap project, and Anton Dziatkovskii is directly related to the project.

address
0x81cfe8efdb6c7b7218ddd5f6bda3aa4cd1554fd2
He is the creator of the CNYQ token and the JPYQ smart contract, which belongs to the QDAO DeFi project, and Anton Dziatkovskii is also the co-founder of the project.

address
0x81cfe8efdb6c7b7218ddd5f6bda3aa4cd1554fd
He is the creator of the NOAH ARK token smart contract. The token NOAHP belongs to the w NoahCity project, and Anton Dziatkovskii is a member of the project development team.

I want to point out the following points with the EasyFi hacker address
0x83a2EB63B6Cc296529468Afa85DbDe4A469d8B37
Many associated wallet addresses (including some intermediate addresses) have MILK, MIRK2, SHAKE, NOAH and QDAO tokens in their balances.

Even address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
(With the common hacker addresses that we already know
0x31499E03303dd75851a1738E88972CD998337403
There are also many mutual transactions) that also contain these tokens.

By the way, the address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912
There are BABYMILK tokens (BabyMilk test token of SpaceSwap v2) on the balance of. At the same time, address 0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912 the token holding chart ranked 13th. Generally, the token holders ranked in this way may be the co-owners of the project or the main investors in the project.

In addition, the address
0x1aa6eb6e5752cc57fd32c91c089083f7ac99c912 (
There have been many interactive transactions with the above hacker address 0x31499E03303dd75851a1738E88972CD998337403), and the address
0x72d49544D17e3C98B0f94D97eE851981279f3aa9
Have been directly related:

https://etherscan.io/tx/0x11cf0326b7b0ee31db33231d2b5eac63763d323f065a72bbfe77baf147e90fe7
https://etherscan.io/tx/0x11cf0326b7b0ee31db33231d2b5eac63763d323f065a72bbfe77baf147e90fe7

address
0x72d49544D17e3C98B0f94D97eE851981279f3aa9
It also belongs to the SpaceSwap project and can be confirmed on the Rarible website .

By examining the block parameters, we can determine that the Nexus Mutual hacker sent funds to:

1. Convert renBTC to BTC through transaction . Withdraw funds through a transaction . Then transfer to the BTC address bc1qmyxuldmsec6xm7gm7dnmmth4lz776tr5mtluvp.

2. Convert renBTC to BTC through transactions .
Withdraw funds through a transaction . Then transfer to the BTC address bc1q6qsnqt98g3aggqy6adlpxkgngughwc66f93dve.

3. Convert renBTC to BTC through transaction . Withdraw funds through a transaction . Then transfer to the BTC address bc1qun448hv5cudqlwrmghju58jnprkguy48emtj8a.

By examining the block parameters, we can determine that the EasyFi hacker sent funds to:

1. Convert renBTC to BTC through transaction . Withdraw funds through a transaction . Then transfer to the BTC address bc1qfl085d0fxy8s6grja5qf8cgqvx8w94ufaygg9y.

2. Convert renBTC to BTC through transactions . Withdraw funds through a transaction . Then transfer to the BTC address 17WFZENdcgkCvVjENQWJnqwXyiCkgTdGbi.

3. Exchange renBTC to BTC through transaction . Withdraw funds through a transaction . Then transfer to the BTC address 1395hgVUB2P7yv145sRbt6Ykbi3qargnoD.

4. Convert renBTC to BTC through transactions . Withdraw funds through a transaction . Then transfer to the BTC address 1DzGYwnUKu9ukGBKm8kTvoezjfCQ2qLwYr.

By examining the block parameters, we can determine that the FinNexus hacker sent funds to:
At the time of writing this article, FinNexus hackers only deposited a Tornado Cash token.

We can observe that hackers withdraw funds through Tornado Cash transactions , which means that ETH-address 0x996f5CcbF2856137744603b382dE559b78a096fC is the recipient of FinNexus hackers using Tornado Cash to send 10 ETH transactions.

Source link: pastebin.com

Is the same hacker attacking Nexus Mutual, EasyFi and FinNexus?

contact@blockcast.cc

Latest articles

Solana (SOL) has seen a notable increase in whale activity

Capital inflows into the crypto market have plummeted by over 70% in just two weeks

Bitcoin’s halving cycles, once the primary driver of massive bull runs, are losing their dominance as the market evolves

Popular Categories

RELATED ARTICLESMORE FROM AUTHOR

Solana (SOL) has seen a notable increase in whale activity

Capital inflows into the crypto market have plummeted by over 70% in just two weeks

Bitcoin’s halving cycles, once the primary driver of massive bull runs, are losing their dominance as the market evolves

contact@blockcast.cc

Latest articles

Solana (SOL) has seen a notable increase in whale activity

Capital inflows into the crypto market have plummeted by over 70% in just two weeks

Bitcoin’s halving cycles, once the primary driver of massive bull runs, are losing their dominance as the market evolves

Popular Categories

RELATED ARTICLES MORE FROM AUTHOR