WBTC Attacker Resurfaces, Returns Part of Stolen Funds

Suspected "address poisoning" perpetrator returns $34.7 million in Ethereum (ETH) to victim, representing 50% of stolen WBTC worth over $71 million. Funds were dispersed to multiple addresses after the initial theft but have now been partially recovered. The attacker's motive and location remain unknown, with initial contact made through a chain message requesting Telegram communication and coinciding with an ETH transfer.

Alleged WBTC Attacker Resurfaces, Restitutes Stolen Funds

In a surprising turn of events, the suspected perpetrator behind the recent "address poisoning" scheme that resulted in the theft of over $71 million in Wrapped Bitcoin (WBTC) has initiated significant transfers of Ethereum (ETH) back to the victim.

The WBTC, an ERC-20 token pegged to the value of Bitcoin on the Ethereum network, was stolen by the hacker, who subsequently liquidated it for 22,960 ETH. These ETH were then dispersed across numerous addresses, likely an attempt to obscure their provenance and launder the proceeds.

However, on March 10th, several blockchain security companies reported that the victim of the attack had started receiving ETH transfers from the exploiter nearly a week after the initial breach.

Intriguingly, the attacker initially established contact with the victim via a blockchain message requesting communication through Telegram. While the intent of this message remains unclear, it coincided with a transfer of 51 ETH (approximately $152,000).

Cyvers, a prominent blockchain security firm, reported on Twitter: "UPDATE: Scammer demands Telegram address from victim. Today: Funds are returning to the victim. Looks like there might have been an agreement at the end."

According to PeckShield, another blockchain security company, the attacker has thus far returned a total of 11,446,87 ETH (approximately $34.7 million) to the victim's address, representing roughly half of the stolen assets.

Despite extensive efforts to identify and locate the hacker, their whereabouts remain unknown. SlowMist's threat intelligence network has identified suspected IP addresses originating from Hong Kong, but the possibility of a VPN being employed cannot be discounted.

This unexpected development raises questions about the motivations behind the attacker's actions. Whether this is a genuine act of remorse, a strategic move to avoid further scrutiny, or part of an intricate laundering scheme remains to be seen.

As the investigation continues, blockchain security experts caution that the use of sophisticated techniques like address poisoning highlights the evolving threat landscape in the cryptocurrency space. They emphasize the importance of implementing robust security measures and exercising vigilance to safeguard digital assets.