WazirX exchange exploiter is on the move again, transferring 5,000 ETH to a new address

According to Blockchain security platform, PeckShield, the walled address associated with the hackers transferred 5,000 ETH

The WazirX exchange exploiter continues to move the stolen funds in batches, with the latest transfer being 5,000 ETH, Blockchain security platform PeckShield has reported.

The exploiter-labeled WazirX address has moved the 11th batch of 5K $ETH (worth ~$13.2M) to a new intermediary address, 0x0641…7b4a.

The latest transfer comes after Cyvers security firm reported another transfer on Sept 3 when 2,600 ETH was moved through Tornado Cash, a mixer platform that hides the trail of crypto transactions.

?ALERT?The @WazirXIndia hacker has begun transferring stolen funds to @TornadoCash at https://t.co/bXF5gBKvxj

The incident, which was revealed by the @Cyvers_ system on July 18, 2024, resulted in a $235M loss.

So far, the attacker has moved 2,600 $ETH $6.5M to Tornado Cash!… https://t.co/egLcmhaYYb

Another transfer of 10,000 ETH was also detected on Sept.19. The fund was sent to address, “0x46b9d..” in 50 different transactions of 100 Ether and 1 transaction of 5,001 ether.

According to DeBank, a crypto tracking platform, one of the hacker’s wallets held $6.7 million on Sept 2. After making about 26 transfers of 100 ETH each within an hour, the wallet now contains only $1.

The WazirX Hack: A Brief RecapThe nightmare started in July when the hackers exploited a flaw in a multi-sig wallet on the exchange, leading to the theft of the $235 million. This has been recorded as one of the biggest breaches in recent crypto history.

Based on the previous report, about $100 million in Shiba Inu (SHIB) tokens and $52 million worth of ether which represents more than 45% of the exchange’s total reserves as of June 2024 were stolen

Warirx has since been under intense scrutiny, with people criticizing the exchange for its lack of proper security. The exchange has engaged in different legal restructuring processes, especially in Singapore

However, WarirX’s founder, Nischal Shetty has shifted the blame multiple times during this restructuring period. Initially, Shetty accused the exchange’s custodian, Liminal, of negligence in the hack, but Liminal denied it.

Later in August, Shetty said that Binance, which held most of the exchange parent company Zattai Labs’ fund, was limiting the company’s ability to compensate its users. But Binance denies the allegation in a blog post, saying that it has no direct control over WazirX’s funds.

I alerted Nischal of WazirX Hack – Cyvers VPIn a recent interview with India youtuber Aditya Singh, Micheal Pearl, the Vice President of Cyver said that the cybersecurity firm flagged an unusual activity in a wallet connected to WarirX on the morning of July 18, 2024, the same day the hack happened.

?ALERT?Hey @WazirXIndia, Our system has detected multiple suspicious transactions involving your Safe Multisig wallet on the #ETH network.

A total of $234.9M of your funds have been moved to a new address. Each transaction's caller is funded by @TornadoCash.

The suspicious… pic.twitter.com/4sajAwd4Hb

Pearl said he reached out to Shettly on WhatsApp and Telegram about the breach. However, there was no immediate response, and by the time Wazir X took action, it was too late. Micheal during the interview,

“But to be honest, after you get hacked, there’s not much you can do. All the necessary steps that you can do, should be done beforehand and not afterward. You can now only assess the magnitude of the damage and see what you can do about it.”