Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bitcoinwhale4064btcfortunecaptured.php}} {{Unattributed Sources}} Different Services Used In LaunderingA bitcoin whale who was likely involved with Genesis Trading and had previously promoted an anonymous donation group on memo.sv saw their entire fortune of 4064.37689539 BTC wiped out. The funds were quickly distributed across a wide range of protoco..."

2024-10-25T20:06:17Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bitcoinwhale4064btcfortunecaptured.php}} {{Unattributed Sources}} thumb|Different Services Used In LaunderingA bitcoin whale who was likely involved with Genesis Trading and had previously promoted an anonymous donation group on memo.sv saw their entire fortune of 4064.37689539 BTC wiped out. The funds were quickly distributed across a wide range of protoco..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/bitcoinwhale4064btcfortunecaptured.php}}
{{Unattributed Sources}}

[[File:Bitcoinwhale4064.jpg|thumb|Different Services Used In Laundering]]A bitcoin whale who was likely involved with Genesis Trading and had previously promoted an anonymous donation group on memo.sv saw their entire fortune of 4064.37689539 BTC wiped out. The funds were quickly distributed across a wide range of protocols including ThorChain, eXch, Kucoin, ChangeNow, Railgun, and Avalanche Bridge. RailGun came out to declare that the thieves had not gained any privacy through their protocol as they had failed the Proof of Innocense model. Some $505k was recovered from swaps conducted through Firn Protocol and NonKYC.io. Firn Protocol closed down their services due to the risk after this incident. Efforts to recover the remaining funds continue.<ref name="slowmisthackedarchive-15256" /><ref name="zachxbttwitter-15257" /><ref name="blockchaindotcom-15258" /><ref name="firnprotocoltwitter-15259" /><ref name="nonkycexchangetwitter-15260" /><ref name="nonkyc-15261" /><ref name="zachxbttwitter-15262" /><ref name="railgunprojecttwitter-15263" /><ref name="ntafftwitter-15264" /><ref name="anytwocardzztwitter-15265" /><ref name="btcdotcom-15266" /><ref name="memo-15267" /><ref name="railgun-15268" /><ref name="firnprotocoltwitter-15269" /><ref name="railgunprojecttwitter-15270" /><ref name="railgundocs-15271" /><ref name="searchdecodertwitter-15272" /><ref name="tobyfrei4twitter-15273" /><ref name="eemalirtwitter-15274" /><ref name="dazai0xtwitter-15275" /><ref name="0xdesignertwitter-15276" /><ref name="hollanderadamtwitter-15277" /><ref name="wazzcryptotwitter-15278" /><ref name="evilcostwitter-15279" /><ref name="oglemurtwitter-15280" /><ref name="loopifyyytwitter-15281" /><ref name="duncan30414908twitter-15282" /><ref name="cryptoslate-15283" /><ref name="cryptonews-15284" /><ref name="dailycoin-15285" /><ref name="misttrack-15286" /><ref name="coinmarketcap-623" />

== About the Bitcoin Whale ==
"It appears that some of the source funds may be related to Genesis Global Trading" "Notably, the wallet had received 642.4 BTC, worth approximately $37.73 million, from the Genesis Trading Bankruptcy Distributions wallet just two weeks before the breach, while another 2,173 BTC, valued at $127.6 million, had been transferred from Genesis Trading two years earlier."

They had also made transactions promoting memo.sv topic hmwyda, which stands for "How much would you donate anonymously?" and features hundreds of users asking for bitcoin donations for various causes, some of which have been funded.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"According to on-chain investigator ZachXBT, a suspicious transfer was made from a potential victim for 4064 BTC ($238M)."
{| class="wikitable"
|+Key Event Timeline - Bitcoin Whale 4064 BTC Fortune Captured
!Date
!Event
!Description
|-
|August 18th, 2024 9:57:29 AM MDT
|Theft Blockchain Transaction
|The theft transaction is accepted by the bitcoin blockchain.
|-
|August 19th, 2024 5:46:00 AM MDT
|ZachXBT Tweet Posted
|ZachXBT posts on Twitter about the suspicious transfer.
|-
|August 19th, 2024 7:21:00 AM MDT
|RailGun No Privacy
|RailGun notes that the tokens sent through their protocol did not gain any proviacy as they could not complete a POI (Proof of Innocence) so they didn't join any privacy set.
|-
|August 19th, 2024 2:31:00 PM MDT
|Funds To Kraken Speculation
|A Tweet suggests that some of the funds may have been sent to Kraken.
|-
|August 19th, 2024 4:00:00 PM MDT
|ZachXBT No Details Shared
|ZachXBT notes it's not his palce to share details about the victim.
|-
|August 26th, 2024 9:25:00 PM MDT
|Return of $205k Firn Protocol
|ZachXBT announces that 80 ETH of funds deposited through the Firn Protocol have now been returned to the victim.
|-
|September 3rd, 2024 4:28:00 AM MDT
|Return of $300k NonKYC.io
|The NonKYC.io platform announces they have assisted with the return of $300k worth of the stolen funds which were attempted to be swapped through their platform.
|}

== Technical Details ==
"While the exact method of the hack remains unclear, experts believe the attackers may have used a combination of phishing, social engineering, and exploiting vulnerabilities in wallet security."

== Total Amount Lost ==
$238,000,000 (4064.37689539 BTC)
$58,483.96 x 4064.37689539 BTC = $237,700,855.77

The total amount lost has been estimated at $237,701,000 USD.

== Immediate Reactions ==
"According to on-chain investigator ZachXBT, a suspicious transfer was made from a potential victim for 4064 BTC ($238M). The funds were quickly moved to ThorChain, eXch, Kucoin, ChangeNow, Railgun, and Avalanche Bridge. As of August 27th, $505,000 has been recovered."

== Ultimate Outcome ==
"After the initial theft, the 4,064 BTC was quickly divided into smaller amounts and transferred across various platforms. This complex series of transactions was designed to make it difficult to trace the funds back to their original source."

"However, when the hackers attempted to use RAILGUN to shield the funds, the effort failed. The stolen Bitcoin did not meet the criteria for privacy within RAILGUN, leading to its unshielding and return, which left the stolen assets exposed rather than protected by the intended privacy protocols."

"Whilst RAILGUN is permissionless and anyone can send tokens in, any tokens that fail to generate a Private POI proof CANNOT enter the privacy set. In this case, the tokens @zachxbt mentioned were unshielded back to the original address and gained no privacy."

"The transaction map further illustrates the movement of a portion of the stolen Bitcoin through the Avalanche Bridge, which likely facilitated cross-chain transfers. This step added another layer of complexity to the hackers’ efforts to obscure the trail.

In addition to using these platforms, the hackers employed mixing services to further complicate the traceability of the funds, effectively combining multiple transactions to mask the origins and destinations of the Bitcoin."

"Per the detailed fund map Xian shared, 3,163.59 BTC originated from three wallets linked to Genesis Global trading. These funds were moved in three transfers of 50 BTC, 1,000 BTC, and 2,113.59 BTC."

"When asked whether the Lazarus Group was responsible for the incident, ZachXBT said “Not this time,” noting that the funds’ movement was “a bit different.”"

== Total Amount Recovered ==
The total amount recovered has been estimated at $505,000 USD.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
Efforts to recover the funds continue.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-15256">[https://web.archive.org/web/20240904160154/https://hacked.slowmist.io/?c=&page=2 SlowMist Hacked - SlowMist Zone] (Accessed Sep 4, 2024)</ref>

<ref name="zachxbttwitter-15257">[https://twitter.com/zachxbt/status/1825499490956231021 @zachxbt Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="blockchaindotcom-15258">[https://www.blockchain.com/explorer/transactions/btc/4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090 Transaction: 4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090 | Blockchain.com] (Accessed Sep 4, 2024)</ref>

<ref name="firnprotocoltwitter-15259">[https://twitter.com/firnprotocol/status/1828272592593010746 @firnprotocol Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="nonkycexchangetwitter-15260">[https://twitter.com/nonkyc_exchange/status/1830915818344837297 @nonkyc_exchange Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="nonkyc-15261">[https://nonkyc.io/legal/aml NonKYC Cryptocurrency Exchange] (Accessed Sep 4, 2024)</ref>

<ref name="zachxbttwitter-15262">[https://twitter.com/zachxbt/status/1825654147271782697 @zachxbt Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="railgunprojecttwitter-15263">[https://twitter.com/RAILGUN_Project/status/1825523502126113150 @RAILGUN_Project Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="ntafftwitter-15264">[https://twitter.com/_ntaff/status/1825511801494094081 @_ntaff Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="anytwocardzztwitter-15265">[https://twitter.com/anytwocardzz/status/1825501753535590670 @anytwocardzz Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="btcdotcom-15266">[https://explorer.btc.com/btc/address/1PaYoyzF4G2BasXkA6trg3URgMAZv51BM7 Address 1PaYoyzF4G2BasXkA6trg3URgMAZv51BM7 - Bitcoin(BTC) - Professional Data Service for Global Blockchain Enthusiasts] (Accessed Sep 4, 2024)</ref>

<ref name="memo-15267">[https://memo.sv/topic/hmwyda Memo - Topic - hmwyda] (Accessed Sep 4, 2024)</ref>

<ref name="railgun-15268">[https://www.railgun.org/ RAILGUN - On-chain ZK Privacy Ecosystem] (Accessed Sep 4, 2024)</ref>

<ref name="firnprotocoltwitter-15269">[https://twitter.com/firnprotocol/status/1829682317729870153 @firnprotocol Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="railgunprojecttwitter-15270">[https://twitter.com/RAILGUN_Project/status/1825643529970004213 @RAILGUN_Project Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="railgundocs-15271">[https://docs.railgun.org/wiki Overview | Wiki] (Accessed Sep 4, 2024)</ref>

<ref name="searchdecodertwitter-15272">[https://twitter.com/SearchDecoder/status/1825642339886346548 @SearchDecoder Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="tobyfrei4twitter-15273">[https://twitter.com/TobyFrei4/status/1825631620310933931 @TobyFrei4 Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="eemalirtwitter-15274">[https://twitter.com/Eemalir/status/1825504329660301521 @Eemalir Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="dazai0xtwitter-15275">[https://twitter.com/dazai_0x/status/1825513991893860378 @dazai_0x Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="0xdesignertwitter-15276">[https://twitter.com/0xDesigner/status/1825522167351595208 @0xDesigner Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="hollanderadamtwitter-15277">[https://twitter.com/HollanderAdam/status/1828396406303871061 @HollanderAdam Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="wazzcryptotwitter-15278">[https://twitter.com/WazzCrypto/status/1825542032565387466 @WazzCrypto Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="evilcostwitter-15279">[https://twitter.com/evilcos/status/1825512182265823243 @evilcos Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="oglemurtwitter-15280">[https://twitter.com/OGLemur/status/1825508955059060852 @OGLemur Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="loopifyyytwitter-15281">[https://twitter.com/Loopifyyy/status/1825519960397123651 @Loopifyyy Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="duncan30414908twitter-15282">[https://twitter.com/Duncan30414908/status/1825501661118267747/photo/1 @Duncan30414908 Twitter] (Accessed Sep 4, 2024)</ref>

<ref name="cryptoslate-15283">[https://cryptoslate.com/bitcoin-stolen-in-238-million-breach-fails-to-get-privacy-shield-returned-to-original-address/ Bitcoin stolen in $238 million breach fails to get privacy shield, returned to original address] (Accessed Sep 4, 2024)</ref>

<ref name="cryptonews-15284">[https://crypto.news/hacked-bitcoin-whale-may-have-lost-238m-zachxbt/ Hacked Bitcoin whale may have lost $238m: ZachXBT] (Accessed Sep 4, 2024)</ref>

<ref name="dailycoin-15285">[https://dailycoin.com/zachxbt-flags-238m-bitcoin-transfer-from-a-potential-victim/ https://dailycoin.com/zachxbt-flags-238m-bitcoin-transfer-from-a-potential-victim/] (Accessed Sep 4, 2024)</ref>

<ref name="misttrack-15286">[https://misttrack.io/s/Vkbao MistTrack Investigation] (Accessed Sep 4, 2024)</ref>

<ref name="coinmarketcap-623">[https://coinmarketcap.com/currencies/bitcoin/historical-data/ Bitcoin price today, BTC live marketcap, chart, and info | CoinMarketCap] (Accessed May 16, 2021)</ref></references>

Bitcoin Whale 4064 BTC Fortune Captured - Revision history