Ledger Hack Update – Movement of Funds

The Ledger Github was hacked and some dAPPs were affected! Ledger has fixed the problem.

The real fun begins now.

Here's the movement of the funds so far.

Looks like at the time of this post 268K is sitting on this wallet – 0x658729879fCa881D9526480B82aE00EFc54B5c2d

A look inside 0x658729879fCa881D9526480B82aE00EFc54B5c2d. As of this post about 228K of stolen funds is sitting here. You can see the out going txns to the right and the victims to the left.

Angel Drainer was used to clean out victims wallets and was paid their cut of about 10k.

A few hours ago, about 160K was moved to this wallet – 0x1b9f9964A073401a8BC24f64491516970bB84E47

Outflow of 0x658729879fCa881D9526480B82aE00EFc54B5c2d. Of interest is all of the different tokens going to 0x1b9f9964A073401a8BC24f64491516970bB84E47. You can see the Angel Drainer fee and a small txn of .013 ETH going to 0xd41138112Ace58D87Db07e4B5ED61740A6cBA6EB.

The hacker swapped all tokens to ETH through Metamask and as of now that's where the funds are.

I'm guessing these will either go through a mixer or an exchange in the next few hours.

I did see a tiny amount of ETH go to this wallet – 0xd41138112Ace58D87Db07e4B5ED61740A6cBA6EB where it eventually ends up at a ChangeNOW deposit address – 0x634984866301511696AC3fdC41Fa4700e11609CE – https://etherscan.io/tx/0x1da2a2faf048b4531305655a07e58105a9b78d7484a37962170dbc11c8b3c708

He could be testing the waters here or paying for VPN / Proxy Services with that txn before making his next move.

Hopefully someone at ChangeNOW is on top of the txn and prepared to freeze if/when additional funds get moved into their deposit addresses.