YFarmX 🗞️
@YFarmX

Frontier Tech News - Crypto, AI, Quantum & Space ▫️The machines 🤖, the money 💸 and the maths 🧮 shaping the future of computation.

yfarmx.com
Joined April 2022
328 Photos and videos
BITGET HACK: we traced the attacker's Zcash test in and back out of the private pool, and it points to a phone wallet. • 19:10 UTC, 25 Sep: 5.10 ZEC test leaves the $29.4m hoard for a fresh address • 19:42 UTC: it goes into Zcash's private pool as four equal notes of 1.2754 ZEC blockchair.com/zcash/transac… • 20:16 UTC: exactly 5.1 ZEC comes back out to a brand-new wallet, t1fS1io…ke1bC blockchair.com/zcash/transac… Our read: that is the same money. It is the only exit of that size in the window, 34 minutes later, built with the same wallet settings. The pool itself hides the step in between, so it stays our read, not proof. The phone: the four-note split is built into Zashi/Zodl, Zcash's official phone wallet. Phone wallets send through a wallet server (lightwalletd), which saw the phone's IP address at 19:42 UTC. That log is one court order away. 18,911.62 ZEC is still unmoved in t1WgMdt…MDVG. @zodl_app @bitget
3
124
BITGET $387.5M HACK, today's update 🧵 The $29.5m in stolen Zcash has started to move. For a full day the 18,916.72 ZEC sat in one address, t1WgMdt…MDVG. Tonight it moved for the first time: • 19:10 UTC: a 5.10 ZEC ($7,956) test went to a brand-new address. The other 18,911.62 ZEC ($29.49m) went back to the same address as change blockchair.com/zcash/transac… • 19:42 UTC: that 5.10 ZEC went into Zcash's private pool, where amounts and addresses are hidden from the public blockchair.com/zcash/transac… The hack started the same way: small tests on TRON and Ethereum at 18:31 UTC, then the big transfers. If the $29.49m follows this test into the private pool, the public trail ends there.
2
4
181
more replies
What hasn't moved: the biggest pile. 68,465.05 ETH ($184.4m) is still in the nine wallets it landed in on 24 September. None of it has left since it arrived. The largest six hold 10,000 ETH each, for example: etherscan.io/address/0xD2C2f… Everything smaller is already on the move: • BNB: 10.14 BNB ($7,855) left, the rest swapped into Bitcoin through THORChain • TRON: 3,349 TRX and 7,169 USDT ($8,297) left, the rest bridged to Ethereum as USDT and sold
1
2
17
Where the $387.5m stands tonight: • Taken: $387.5m, Bitget's revised figure • Still on Bitget's attacker list: $387.1m at tonight's prices, all chains • Frozen: $339,023 by Tether and Circle • At the Vault: 614.90 ETH ($1.66m), off Bitget's list The Vault ETH is not extra theft. It's stolen XRP turned into ETH, now held by a service that pools its customers' money, so an attacker list doesn't show it. Our full trace: yfarmx.com/bitget-postmortem…
1
15
YFarmX 🗞️ retweeted
Hayden Adams 🦄
@haydenzadams
9h
Some bangers from the SEC today: 1) buybacks do not make a commodity token into a security 2) liquid staking tokens for commodities are not securities sec.gov/about/divisions-offi…
64
263
1,967
206,160
BITGET $387.5 HACK: where the money is now (15:22 UTC, 25 Sep) Bitget has raised the total to $387.5m, adding Zcash and TRON. We checked every wallet on its attacker list: • ETH: 68,467 ETH ($184.6m), still sitting in the same wallets • XRP: 98.2m XRP ($156.1m), 4.5m started moving today • Zcash: 18,917 ZEC ($29.5m), still in the receiving address • Bitcoin: 215.7 BTC ($18.1m), where the BNB was swapped through THORChain today • BNB: all but 10 BNB swapped. TRX: all 20.6m left the attacker address this morning At today's prices the stash is worth $388.3m, a little more than was taken. Bitget offers 5% to anyone who helps freeze or recover funds. Its withdrawal plan is due by 04:00 UTC tomorrow. Full postmortem: yfarmx.com/bitget-postmortem…
2
2
117
BITGET HACK UPDATE: the hacker has turned nearly all the stolen BNB into Bitcoin. • 5,897 BNB ($4.55m) went through 23 fresh wallets and 29 THORChain swaps between 05:36 and 08:12 UTC • 48.74 BTC ($4.12m) has landed so far, each payout naming a deposit we traced • The Bitcoin is swept into one collector address and sent on in chunks The ETH and XRP ($341.7m) still haven't moved. The collector address mempool.space/address/bc1qdp… A THORChain swap from the hacker's BNB, paying Bitcoin straight to it bscscan.com/tx/0x8ef619934d8… Full trace: yfarmx.com/bitget-postmortem…
3
226
BITGET HACK: the hacker is now cashing out into Bitcoin, and the BNB has started moving. 1️⃣ 28.24 ETH ($75.7k) from the cash-out wallet went into THORChain at 04:18 UTC and came out as 0.8919 BTC ($75.2k) at 05:23. The Bitcoin payout's memo carries the ETH tx hash, so the link is on-chain. 2️⃣ 05:26 UTC: first move out of the BNB wallet. 1,889.6 BNB ($1.46m) to a fresh wallet, then 416 BNB ($321k) peeled on at 05:31. $345.1m still in their wallets. ETH into THORChain etherscan.io/tx/0xe98d4f3738… BTC payout mempool.space/tx/2cacf0e0dd8… BNB out bscscan.com/tx/0xbdf9bfd6381… bscscan.com/tx/0xd55ea057ad5…
2
2
6
409
The hacker is now swapping BNB for Bitcoin. 1,386 BNB ($1.07m) went into THORChain in five swaps between 05:36 and 05:48 UTC, each paying out in BTC. One swap pays the same Bitcoin address that received the ETH cash-out an hour earlier, which ties the two together on-chain. $344.1m still in their wallets. BNB into THORChain: bscscan.com/tx/0xc261100c9f7… bscscan.com/tx/0x22ec6ef0ca2… (pays the same BTC address as the ETH cash-out) bscscan.com/tx/0x1f2a7d97243… The shared Bitcoin address: mempool.space/address/13RcS1…
2
140
BITGET $350M HACK, traced on-chain in 60 seconds 🎥 • 90% of every hot wallet, taken by one routine • One XRP payment bounced. Bitget refilled the wallet. $14.3m more went out • 03:45 UTC today: 484.65 ETH joined the hacker's main wallet $348m tracked. The full trace, every wallet and every hash: yfarmx.com/bitget-postmortem… The tracing continues. Follow @yfarmx
3
5
437
The Bitget hacker's cash-out is speeding up (02:54 UTC, 25 Sep). The money pulled out through the Bridgers bridge is now being pooled. The three cash-out addresses emptied and swept their ETH into one fresh wallet, which holds about 26 ETH so far, up from 19 ETH an hour ago: etherscan.io/address/0x00154… The five deposits into it: -etherscan.io/tx/0x63b994a19e… -etherscan.io/tx/0x1a50897e86… -etherscan.io/tx/0xa7d9cb27c3… -etherscan.io/tx/0x437615102d… -etherscan.io/tx/0x59a750537e… Separately, the Optimism stash moved for the first time: 495.6 WETH ($1.33m) left its wallet into another delegated wallet, then straight on. The main hoard is still untouched: 67,981 ETH, 5,896 BNB and 82.98m XRP have not moved. Follow @yfarmx for updates.
1
1
4
454
Update: Circle's CCTP moved $1.3M to Ethereum in about 10 seconds. The Bitget hacker's Optimism slice: 495.6 WETH ($1.33m) on Optimism was swapped into ~1.3m USDC. That USDC was burned into Circle's CCTP and minted on Ethereum at 02:55:23 UTC, roughly ten seconds after the burn (a CCTP fast transfer). It was swapped back to ~484 ETH and pooled into the hacker's main consolidation wallet, 0xA6dD…5545, by 03:08 UTC. Whole trip, Optimism to Ethereum and into the pile: about 13 minutes. Nothing has been moved out beyond the small XRP-to-ETH drip. Mint (Ethereum): etherscan.io/tx/0xe561ab5186… Burn (Optimism): optimistic.etherscan.io/tx/0…
1
2
120
There was a 10 second window to freeze the USDC on ethereum.
16
The Bitget hacker has started to test cashing out, and we caught the first move. From 00:24 UTC today, stolen XRP began flowing through Bridgers, a cross-chain swap service run by SWFT. So far about 33,500 XRP ($51,400) has been turned into 17.02 ETH ($45,800) and sent to three Ethereum addresses. It's tiny, $51k against $158m of XRP still sitting untouched, so this reads as a test run before a bigger cash-out. Bridgers is a bridge, not an exchange, which is exactly where a freeze request or a records request should be aimed now. Everything else, all the ETH, the rest of the XRP and the BNB, has not moved.
1
5
567
Update: $1.3m bridged from Optimism to Ethereum. The Bitget hacker's Optimism slice, tracked start to finish: 495.6 WETH ($1.33m) on Optimism was swapped into ~1.3m USDC. That USDC was burned into Circle's CCTP and minted on Ethereum at 02:55:23 UTC, roughly ten seconds after the burn (a CCTP fast transfer). It was swapped back to ~484 ETH and pooled into the hacker's main consolidation wallet, 0xA6dD…5545, by 03:08 UTC. Mint (Ethereum): etherscan.io/tx/0xe561ab5186… Burn (Optimism): optimistic.etherscan.io/tx/0… Follow @yfarmx for updates
1
64
BITGET HACK: $348M TRACKED. YFarmX’s postmortem is live: The XRP trail, failed withdrawals and dated snapshots locating $348.3m. Follow this link and bookmark the page. We’ll keep updating it with the latest information we find. yfarmx.com/bitget-postmortem…

Bitget hack: the XRP trail and failed withdrawal explained | YFarmX

Bitget says attackers compromised its wallet backend. YFarmX traces about $350.66 million in receipts and finds a failed XRP withdrawal sized against an earlier balance.

yfarmx.com
2
6
361
How the Bitget hacker moved $351.6m across the blockchains, step by step. After draining the wallets, the attacker had funds stranded on five different networks. To gather them in one place, they pushed everything onto Ethereum using ordinary public bridges, the same tools normal users use every day. No mixer has been touched at any point, yet. Moving the loot onto Ethereum: • Across - Arbitrum to Ethereum, 1,600 ETH • MetaMask Bridge - Arbitrum to Ethereum, 4,339 ETH • Stargate - Optimism and Base to Ethereum • deBridge - Optimism to Ethereum, 495 ETH+ • Relay - Base to Ethereum • MetaBridge - a 1 ETH test on Ethereum Then the cash-out began: • Bridgers (SWFT) - XRP Ledger to ETH, 19+ ETH so far Sample transactions (verify on the chain's explorer): Across 0xfbf6309b7359559488cc4d4c4268fb63e19d5b7d795c5f6db1db6b9a3453636b MetaMask Bridge 0xba72a0d1c851cfce64197fd451c0241307e5397ce561dfbf281d111085e4af82 Stargate 0xe3b2a1835158a6431d55ede5fac98e77264ef9a8ab92246697d9fe67aec6b2ca deBridge 0x0684c734ae6473f6e5c3c120eeda7cb78404f6b773205ca1ed53d56ab846c1ed Relay 0xa81e944526e8d7bfb2a5d78911f4356a71de77b3123b323743308a91da40f8e6 MetaBridge 0x32b0fa47a3041cf0d808fd7eb6980ea070b2ec51529131d5795692525bc340ca Bridgers (SWFT) - SwftSwap contract 0xc1d13492285eb664951e201bf7c80c7c6318a1b5 1/2 🧵👇
1
6
443
Every service the Bitget hacker used after the theft, and what each one did. The attacker used mainstream, public crypto services in three stages: sell, move, cash out. Sell (turn stolen tokens into ETH, which no issuer can freeze): • Uniswap - UniswapX and v3/v4 sold about $80m of USDT, USDC and tokenised gold into ETH • 1inch Fusion - named in the reported Arbitrum swap (about $20m into 7,111 ETH) The tools that made it possible: • Permit2 - unlimited token approvals set up for the sell orders • MetaMask smart accounts - EIP-7702 delegation on the swap wallets Move (gather it all onto Ethereum): • Across, Stargate, Relay, deBridge, MetaMask Bridge • Circle CCTP - Avalanche USDC burned and re-minted on Ethereum • Mayan Swift and Celer cBridge - the BNB feeder route Cash out (start turning it into fresh ETH): • Bridgers (SWFT) — XRP Ledger to ETH, 19+ ETH so far, a rehearsal against $158m of XRP still held No mixer at any hop yet. Every service is public infrastructure. 2/2
1
169
Load more