Security firm Peckshield reported a hack of two Bitmart wallets that used a 1-inch DEX aggregator to exchange stolen tokens for ETH.
Two BitMart hot wallets have been hacked. One of the hot wallets was an ETH wallet, the other a BSC wallet. The method of attack is not yet known, although BitMart estimates losses at around $150M. The other BitMart hot wallets are intact, and BitMart is undertaking a security review and has suspended withdrawals until further notice.
Via BitMart’s official Telegram channel, it claims that withdrawals from these wallets were not unusual, but later admitted to the attack via the CEO’s Twitter. As a result of the hack, BitMart’s native exchange token has fallen 9.7% in the past 24 hours and now stands at $ 0.323248.
Losses understated, says Peckshield
Blockchain security company Peckshield Inc estimates the losses to be in the region of $196M, with approximately 100M lost from the ETH wallet and roughly $96M on Binance Smart Chain. The affected BSC assets include SAFEMOON, X2P, FLNS, BabyDoge, HERO, STARSHIP, FLOKI, JULb, CMCX, GMR, SPE, BETU, GMEX, ZOE, MOONSHOT, BPAY, STACK, EnergyX, BSC-USD, and BNB. Peckshield has revealed from its own investigation of the attack that the hacker withdrew funds from hot wallets and swapped them for ETH using the DEX aggregator called 1inch.
The funds were then channeled through Tornado Cash, a privacy blending protocol for the Ethereum blockchain that breaks the chain link between source and destination addresses using a smart contract that acts as a pool that accepts ETH deposits from an address and, and allows withdrawal of another address. The mixer aggregates funds from multiple users before a transaction reaches its destination. Once the mix is done, it’s not easy to know where the money went, who made the trade, and how much crypto was involved in the trade.
Huobi commits to helping BitMart
It is helpful if other crypto exchanges are alert to large deposits being made from the Tornado Cash platform. Huobi has indicated via its Twitter account that they are willing to assist to identify inflows of assets involved in the hack.
Tornado Cash was developed from open source research by the The Zcash team. Tornado Cash was also used as an anonymizer in the MonoX Finance DeFi protocol hack earlier this week.
