WBTC 攻击者卷土重来，归还部分被盗资金

涉嫌“地址中毒”的犯罪者向受害者返还了 3470 万美元的以太坊 (ETH)，相当于被盗 WBTC 的 50%，价值超过 7100 万美元。最初被盗后，资金被分散到多个地址，但现已部分追回。攻击者的动机和位置仍然未知，最初的联系是通过请求 Telegram 通信的链式消息进行的，并且与 ETH 传输同时发生。

Alleged WBTC Attacker Resurfaces, Restitutes Stolen Funds

涉嫌 WBTC 攻击者重新露面，归还被盗资金

In a surprising turn of events, the suspected perpetrator behind the recent "address poisoning" scheme that resulted in the theft of over $71 million in Wrapped Bitcoin (WBTC) has initiated significant transfers of Ethereum (ETH) back to the victim.

令人惊讶的是，最近“地址中毒”计划导致价值超过 7100 万美元的 WBTC 被盗，嫌疑人已开始将大量以太坊 (ETH) 转回给受害者。

The WBTC, an ERC-20 token pegged to the value of Bitcoin on the Ethereum network, was stolen by the hacker, who subsequently liquidated it for 22,960 ETH. These ETH were then dispersed across numerous addresses, likely an attempt to obscure their provenance and launder the proceeds.

WBTC 是一种与以太坊网络上的比特币价值挂钩的 ERC-20 代币，被黑客窃取，随后黑客将其变现为 22,960 ETH。然后，这些 ETH 被分散到多个地址，可能是为了掩盖其来源并洗钱。

However, on March 10th, several blockchain security companies reported that the victim of the attack had started receiving ETH transfers from the exploiter nearly a week after the initial breach.

然而，3 月 10 日，多家区块链安全公司报告称，攻击的受害者在最初的漏洞发生近一周后就开始收到来自攻击者的 ETH 转账。

Intriguingly, the attacker initially established contact with the victim via a blockchain message requesting communication through Telegram. While the intent of this message remains unclear, it coincided with a transfer of 51 ETH (approximately $152,000).

有趣的是，攻击者最初通过区块链消息与受害者建立联系，请求通过 Telegram 进行通信。虽然此消息的意图尚不清楚，但它与 51 ETH（约 152,000 美元）的转账同时发生。

Cyvers, a prominent blockchain security firm, reported on Twitter: "UPDATE: Scammer demands Telegram address from victim. Today: Funds are returning to the victim. Looks like there might have been an agreement at the end."

著名的区块链安全公司 Cyvers 在 Twitter 上报道称：“更新：骗子要求受害者提供 Telegram 地址。今天：资金正在返还给受害者。看起来最终可能达成了一项协议。”

According to PeckShield, another blockchain security company, the attacker has thus far returned a total of 11,446,87 ETH (approximately $34.7 million) to the victim's address, representing roughly half of the stolen assets.

据另一家区块链安全公司 PeckShield 称，迄今为止，攻击者已将总计 11,446,87 ETH（约 3470 万美元）返还至受害者地址，约占被盗资产的一半。

Despite extensive efforts to identify and locate the hacker, their whereabouts remain unknown. SlowMist's threat intelligence network has identified suspected IP addresses originating from Hong Kong, but the possibility of a VPN being employed cannot be discounted.

尽管采取了大量努力来识别和定位黑客，但他们的下落仍然不明。慢雾的威胁情报网络已识别出来自香港的可疑 IP 地址，但不能忽视使用 VPN 的可能性。

This unexpected development raises questions about the motivations behind the attacker's actions. Whether this is a genuine act of remorse, a strategic move to avoid further scrutiny, or part of an intricate laundering scheme remains to be seen.

这种意外的事态发展引发了人们对攻击者行为背后动机的质疑。这是否是真正的悔恨行为，是避免进一步审查的战略举措，还是错综复杂的洗钱计划的一部分，还有待观察。

As the investigation continues, blockchain security experts caution that the use of sophisticated techniques like address poisoning highlights the evolving threat landscape in the cryptocurrency space. They emphasize the importance of implementing robust security measures and exercising vigilance to safeguard digital assets.

随着调查的继续，区块链安全专家警告说，地址中毒等复杂技术的使用凸显了加密货币领域不断变化的威胁格局。他们强调实施强有力的安全措施并保持警惕以保护数字资产的重要性。