1). Introduction

2). CoinBerry, Unibright, & CoinMetro hacks

3). Nexus Mutual founder hack

4). EasyFi hack

5). Bondly hack

6). Unreported hacks

7). MGNR and PolyPlay hacks

8). bZx hack

9). Steadefi and CoinShift hacks

10). Paxful and Noones accounts

11). Investigation results

12). Other Incidents

13). Acknowledgments

Introduction

Bluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as 2009 primarily being financially motivated utilizing malware custom built for each target.

Early on, the threat group gained notoriety for cyberattacks such as Sony Pictures Hack in 2014 and $81M Bangladesh Bank heist in 2016 and in more recent years has shifted focus to targets in the cryptocurrency industry.

Analytics firms such as TRM and Chainalysis release annual reports summarizing crypto related incidents linked to DPRK and since 2017 they estimate between $3B to $4.1B has been stolen.

The research in this article closely follows 25 hacks targeting companies and individuals in the cryptocurrency space spanning from August 2020 to October 2023 by tracing the movements of funds to multiple accounts identified at P2P marketplaces where Lazarus Group exchanges stolen crypto for fiat.

2020 — CoinBerry, Unibright, & CoinMetro Hacks

CoinBerry Incident Summary

On August 24, 2020 the Canadian crypto exchange CoinBerry stopped processing withdrawals for 12+ hrs after $370K was drained from the Bitcoin and Ethereum hot wallets. While the exchange never publicly reported the incident, a lawsuit filed in 2022 revealed a software bug allowed 500 users to withdraw 120 BTC in 2020.

Theft address

0xA06957c9C8871ff248326A1DA552213AB26A11AE

1KcTk7kJMjYaCV3FXo5bzpjaZs2aK18ntz

Unibright Incident Summary

ON September 11, 2020 the Unbright team noticed unauthorized transfers of $400K from multiple wallets controlled by the team as the result of a private key compromise. The attacker immediately swapped the assets for ETH on decentralized exchanges.

Theft address

0x6C6357F30FCc3517c2E7876BC609e6d7d5b0Df43

CoinMetro Incident Summary

On October 6, 2020 the CoinMetro team observed unauthorized transfers of $750K worth of crypto assets from its hot wallets due to a security breach. As a result of the incident the Parsiq team made the decision to hard fork its token in an effort to prevent the attacker from further selling PRQ tokens and further protect users funds.

Theft address

0x044bf69ae74fcd8d1fc11da28adbad82bbb42351

1GVjvbVEYPkjCYCwJkC29t5pBWAQQd1g32

On-chain aspects

Funds from thefts such as CoinMetro, CoinBerry, Unibright, and individuals were transferred through intermediary wallets before consolidating in 0x0864 in early January 2021.

3000 ETH was deposited to Tornado Cash by 0x0864 on January 11, 2021 beginning at 2:54 am UTC and concluding at 9:14 am UTC.

0x0864b5ef4d8086cd0062306f39adea5da5bd2603

After 1814.49 ETH was transferred from 0x0864 to 0x1031 and 17 X 100 ETH was deposited to Tornado Cash on January 11,2021.

0x1031ffaf5d00c6bc1ee0978eb7ec196b1d164129

An additional 112.1 ETH was deposited to Tornado cash by 0x1031 from January 14–16, 2021.

45 X 100 ETH was withdrawn from Tornado Cash to a single address beginning on January 11, 2021 at 2:35 pm UTC and concluding on January 14, 2021 at 11:52 pm UTC.

0x05492cbc8fb228103744ecca0df62473b2858810

All Tornado Cash withdrawals for the month of January 2021 were reviewed and no additional withdrawals were found which shared similar characteristics. Additional comfort is gained with the demix as the Tornado withdrawal destination address connects back with the original theft address.

Transfer laundered funds to P2P exchanges

Through a series of transactions, the funds sitting in 0x0549 were transferred through intermediary addresses and consolidated with funds from other Lazarus Group thefts before USDT was deposited to the P2P marketplace Paxful beginning in July 2022. In April 2023 they began using Noones, another P2P marketplace. They continue slowly transferring USDT in batches until November 2023.

Paxful deposit address:

0x246569f8b420c8d850c475c53d0d59973b3f08fc

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address:

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

Transfer funds from theft to OTC trader

Additionally, in 2021 multiple transfers were made from the 0x9973 address to Wu Huihui, a China-based OTC trader. In April 2023, an indictment against Wu was unsealed alleging that he facilitated payments for DPRK and he was added to the OFAC SDN list.

December 2020 — Nexus Mutual founder (Hugh Karp) hack

Incident summary

On December 14, 2020 Hugh Karp, founder of Nexus Mutual was tricked into approving a malicious transaction that transferred out 370,000 NXM ($8.3M) after an attacker gained remote access to his computer and modified his Metamask extension.

On-chain aspects:

The post-mortem blog post by Hugh Karp lists the theft addresses on Bitcoin and Ethereum.

BTC theft address

3DZTKLmxo56JXFEeDoKU8C4Xc37ZpNqEZN

ETH theft address

0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1 0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b 0x09923e35f19687a524bbca7d42b92b6748534f25 0x0784051d5136a5ccb47ddb3a15243890f5268482 0x0adab45946372c2be1b94eead4b385210a8ebf0b

From December 16–17, 2020 the attacker deposited 137.1 BTC into the centralized mixing service ChipMixer in six deposits:

ChipMixer deposits — December 16

Deposit 1: 1 BTC at 9:55 am UTC

906b3436067e48f3355f8cb5266c0055787d8cd378d3fe99e7020eecdde2ca74

Deposit 2: 5 BTC at 10:09 am UTC

5ce61bc9bec2ff7a5291b48903441a39fab6df59934cf75b7cd1abee67ac8017

Deposit 3: 30 BTC deposited at 10:22 am UTC db0cd0f1cb5bd13b9b3249e6a560aaeddbd0134d0f678220e626b20a424473ce

Deposit 4: 50 BTC deposited at 11:44 am UTC 1586fec6363ba1d6bac3056e4aee0bc0b4fefdf37f6060850b2d9168c39e6683

Deposit 5: 41.99 BTC deposited at 13:51 pm UTC eb4854fb3ea8a3f5d87331b04bfc4daeac76343ebcbcaeff976551fadb5050cc

ChipMixer deposits — December 17

1aa32442bfcbee3981e038d50a05885d35fd1d4ec33af5a9bd40e5d1dc88a686

Hours after the deposits, a matching amount of 136 BTC was withdrawn from ChipMixer and bridged back to Ethereum via Ren Project and consolidated with funds from other thefts.

Withdrawals consolidate 1: 4.61 BTC at 10:14 am UTC 18b9481573afb349c499ed5469ed903db5289b7946daddc1961e945b3d4d3cb7 Withdrawals consolidate 2: 5.42 BTC at 12:39 pm UTC a88a7d86bbd780f42850472feffcb626684b3df7b2f7c062e3b12009224e609d Withdrawals consolidate 1 : 15 BTC at 12:56 pm UTC 0b6b1a990b6aab6edaef925c4af2a03f64c1a03ee98d3309f9557029af415f66 Withdrawals consolidate 2 : 60 BTC at 14:14 pm UTC 9726abb675bff14f512018a583693e815857829dc2459556938a491900638e21 Withdrawals consolidate 3 : 42 BTC at 23:33 pm UTC ffeb3dd56d0bde492cd08c0975edad38524f5ef003f55c258e75638044324acf Withdrawals consolidate 4: 9.1 BTC on December 17 at 7:17 am UTC a63eea88c4f9304e7e6c582a586b720c1dd50d671f8f6077143968eea2a3f97b

Ren Protocol ETH destination address: 0x78a9903af04c8e887df5290c91917f71ae028137

On the Ethereum side 2,571 ETH (25 X 100 ETH, 7 X 10 ETH, 1 X 1 ETH) was deposited into Tornado Cash from December 16–19 by theft address 0x0784051d5136a5ccb47ddb3a15243890f5268482

Beginning just hours after deposits the 0x78a Ren destination address started receiving withdrawals from Tornado Cash. 0x78a9903af04c8e887df5290c91917f71ae028137

While not being a 1:1 match we can gain confidence this demix is accurate as Lazarus Group linked the post-mix address with the original theft address on December 25, 2020 reducing the effectiveness of the anonymity set as seen in the TRM graph below:

March 2021 — ChipMixer Activity

In March 2021 Lazarus Group sold additional wNXM for renBTC before bridging 89.5 renBTC in total to Bitcoin via Ren Protocol and then depositing to ChipMixer.

March 10th–29.98 renBTC was bridged to Bitcoin via Ren Protocol and deposited to ChipMixer in one transaction. Five hours later a matching amount of 29.92 BTC was withdrawn from ChipMixer and bridged via Ren back to Ethereum where the funds consolidate with other stolen funds in 0x0864b from the CoinMetro hack and unreported individual hacks.

0x0864b5ef4d8086cd0062306f39adea5da5bd2603

March 20th — 13.13 renBTC was bridged to Bitcoin and immediately bridged back to Ethereum via Ren Protocol and consolidates with stolen funds from the CoinMetro hack before 67.63 renBTC was bridged back to Bitcoin and four deposits were made to ChipMixer. Shortly after the deposits five withdrawals were made from ChipMixer in matching amounts adjusted for fees.

Funds were bridged via Ren from Bitcoin to Ethereum where they consolidate with the NXM batch laundered in December 2020 in 0xb27.

0xb27d40fb4a7975e6f4e6bd7f9fbf6e8d53bf8298

March 31st — 46.49 renBTC was bridged to Bitcoin via Ren and five deposits were made ChipMixer. Within minutes of the deposits six addresses begin receiving withdrawals in matching amounts. Funds were bridged back to the same destination address 0x58e5 on Ethereum.

The accuracy of this demix can be confirmed since the withdrawal address of 1.56 BTC connects to the original NXM theft address from funds bridged via Ren in November 2020. This is highlighted in pink in the TRM graph below.

Transfer laundered funds to P2P exchanges:

In April 2021 19.96 BTC was bridged from Ethereum to Bitcoin via Ren where it was transferred to Wu Huihui, an OFAC sanctioned OTC trader.

$11M from 0xb27 was transferred to a Bixin deposit address from May 24-July 10, 2021 .

February 2023 the remaining funds in 0xb27 were transferred to 0xcbf0 where they consolidated with funds from other thefts and were deposited to Paxful and Noones.

Bixin deposit address

0x8e7f5d85c3587725b1188d3cc04ca814ab60cdce

Paxful deposit address

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

April 2021 — EasyFi founder (Ankitt Gaur) hack

Incident Summary

April 19, 2021 EasyFi team observed large unauthorized transfers of EASY tokens from team wallets controlled by the founder Ankitt Gaur after his device had been injected with a malicious version of Metamask allowing the attacker to gain control of the private keys resulting in $81M stolen.

Further analysis revealed that a few days prior Ankitt Gaur had received a phishing email to his personal email address via sendgrid which appeared as if it had been sent from the Pantera Capital founder Dan.

Notably this type of attack resembled what happened to Hugh Karp (Nexus Mutual Founder) in December 2020.

On-chain aspects

$6M of USD/DAI/USDT of liquidity was removed from protocol pools and 2.98M EASY was transferred to 0x4371

0x437147DA920714feC4822F0666D940945f9c972B

The attacker can be linked to Nexus Mutual, CoinMetro, Unibright, Coinberry, and multiple individual thefts on-chain as addresses from each incident transfer ETH to 0x3149 in March-April 2021.

0x31499e03303dd75851a1738e88972cd998337403

April 2021 — Laundering

From April 20–21, 2021 a total of 209.64 BTC from the theft address was bridged from Ethereum and deposited to ChipMixer from the hack.

A volume and timing analysis was performed and from April 20–21, 2021 a total of 209.5 BTC was withdrawn from ChipMixer matching the amount deposited adjusted for fees. There were no other withdrawals during that period which showed similar characteristics.

209.22 BTC from the Chipmixer withdrawals were consolidated to two addresses on April 22, 2021 and then bridged back to Ethereum using Ren protocol.

Ren bridge source transaction —

Amount: 179.47 BTC

84b7c4a2b79d454bbb1636d6d872ed367bbcf4b664193b7b8baded8675085935

Date: April 22, 2021 at 2:00 AM UTC

35TjCuKRbKcofxnKG2EkC8B66ZNXKqE1aN

Amount: 29.75 BTC

3e3b2950c72f863642db0a1bd248be3009ba65e9fa950d5a3094a7b1d7b14e2e

Date: April 22, 2021 at 2:00 AM UTC

3M8VZjtAqi51LsMuRGGY9mhPvQk5hvubvt

Ren bridge destination transaction —

0xbeb56f2ad2b41339c377cbdb713e88b565af5bba407de24edaabf473a82967fd

0x313d06759af5696d6ee3f5965408e9c5b658fb7e

0x75c6615cdcdd5ce97c1c30357c64762ab3ab8fa0357fe290b8b6e3afd3a85463

0xe0c79066488a15b70361ad8268d713b05944a4fe

Funds received to 0x313 and 0xe0c7 mostly stays dormant until June 2022 when funds were transferred to new EOA addresses and consolidate with stolen funds from other thefts tied to Lazarus group.

In June 2022 $4.9M from multiple hacks was then transferred to two Binance deposit addresses:

0x27a9d7d17d72a5a67115dbf381b121b51d8b5dd8

0xabef0df725ef5d2f0354c59ea3ccb161abc11515

April 28, 2021 another batch of 6.31 renBTC was bridged to Bitcoin using Ren Protocol and then deposited to ChipMixer at 7:20 am UTC.

0a6f220fdc821ec1743a9a201e16a038d474b1554520e9922734e6c62628e7b2

Minutes later at 7:29 am UTC an address received 6.305 BTC from ChipMixer matching the amount deposited adjusted for fees.

4e35b2214a12f8d49cdd0100d71f7573ee47dd6a575e149eb1529285b7effff9

All funds were bridged back to Ethereum address 0xe0c7 using Ren bridge.

0xe0c79066488a15b70361ad8268d713b05944a4fe

Transfer laundered funds to P2P exchanges

Through a series of transactions, the funds sitting in 0xe0c7 and 0x313d were converted to DAI and wBTC, transferred through intermediary addresses, consolidate with funds from other Lazarus Group thefts , and USDT was deposited to the P2P marketplace Paxful beginning in July 2022. In April 2023 they began using Noones, another P2P marketplace. They continued slowly sending USDT in batches until November 2023.

Paxful deposit address

0x246569f8b420c8d850c475c53d0d59973b3f08fc

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

July 2021 — Bondly hack

Incident summary

On July 14, 2021 Brandon Smith, CEO of Bondly Finance fell victim to an attack where the malicious actor gained access to a password account containing the recovery phrase for his hardware wallet. Soon after the attacker transferred ownership of the Bondly token contract to themselves and $8.5M of assets belonging to the team.

On-chain aspects

The post-mortem blog post by Bondly co-founder Harry Liu highlights the theft addresses on Ethereum, BSC, and Polygon.

Ethereum, BSC, and Polygon theft address

0xc433d50dd0614c81ee314289ec82aa63710d25e8

Laundering July 2021

Tornado Cash deposits — BSC

Through a series of transactions, 48 X 100 BNB was deposited to Tornado Cash by the attacker beginning on July 15, 2021 at 5:41 am UTC and concluded on July 16, 2021 at 6:33 am UTC.

Tornado Cash deposits — Ethereum

Through a series of transactions, 5X 100 ETH and 52 X 100,000 DAI was deposited to Tornado Cash by the attacker beginning on July 15, 2021 at 8:15 am UTC and concluding on July 16, 2021 at 2:17 am UTC. On August 11, 2021 an additional 202 ETH was deposited to Tornado Cash.

Tornado Cash withdrawals — BSC

From July 17–19th 47 X 100 BNB was withdrawn to 0x4197 on BSC. This matches the deposits 1:1 as one of the Tornado deposits was withdrawn to the depositor 0xc433.

0x419787019b991ac2c765a14467d177c6c0b05c00

Funds were then bridged from BSC to Ethereum via Multichain bridge and consolidated with the Ethereum withdrawals.

Tornado Cash withdrawals — Ethereum

From July 16–20th 35 X 100,000 DAI and 3 X 100 ETH was withdrawn to 0x365 consolidating with the 100 BNB Tornado Cash withdrawals.

0x365d2c5220989a068d8b0e95625875c55166297b

From July 22–29th 14 X 100,000 DAI and 2 X 100 ETH was withdrawn to 0xe0c7 consolidating with funds from the EasyFi hack. From August 12–23th 2 X 100 ETH was withdrawn to 0xe0c7.

0xe0c79066488a15b70361ad8268d713b05944a4fe

On July 24th 2 X 100,000 DAI was withdrawn to 0xdef5 which received $7.4M from 0xe0c7 in a series of transactions.

0xdef57ccb20b1f2eaee0c64aab3280350f84cb0fc

The remaining 1 X 100,000 DAI withdrawal was made to 0x996f.

0xd7589fdf5c035ce5d432e5af64b13b77802b7451315f460ce1bda8a4e7c89240

0x996f5ccbf2856137744603b382de559b78a096fc

The Tornado Cash 100,000 DAI pool sees little activity and the 52 deposits made by the Bondly attacker increased the pool by 15% significantly reducing the effectiveness of the anonymity set. The graph below shows the cumulative balance of the 100,000 DAI pool from July 11–25, 2021 shows a sudden increase in deposits before matching withdrawals.

In June 2022 $4.9M laundered from hacks such as Nexus Mutual, EasyFi, and Bondly was transferred to two Binance deposit addresses:

0x27a9d7d17d72a5a67115dbf381b121b51d8b5dd8

0xabef0df725ef5d2f0354c59ea3ccb161abc11515

Transfer laundered funds to P2P exchanges

Through a series of transactions, the funds sitting in 0xe0c7 and 0x365d were transferred through intermediary addresses and consolidate with funds from other Lazarus Group thefts such as EasyFi and the Nexus Mutual founder before USDT was deposited to the P2P marketplace Paxful beginning in July 2022. In April 2023 they began using Noones, another P2P marketplace. They continue slowly sending USDT in batches until November 2023.

Paxful deposit address

0x246569f8b420c8d850c475c53d0d59973b3f08fc

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

August and September 2021 — Unreported Hacks

August and September 2021 saw multiple individuals hacked for $2M likely due to private key compromise. Indicators of the thefts include on-chain connections to known hacks such as FinNexus, assets transferred out from victims wallets and immediately sold for ETH, and activity in victims wallets stopped after transfers were made.

Theft address

0x5271b379f3e1954e20791142d734596a3de28efd

0xc35a06d02471acc48e552e99d8b860bac73cbe9d

0x40d7b7A55dd51ee94A9a4788311e39CB362Fe1Ea

Funds from the multiple thefts consolidated in 0x5271 before 581 ETH was deposited to Tornado Cash on September 15, 2021 beginning at 10:13 am UTC.

591 ETH was withdrawn from Tornado Cash to a single address on September 20, 2021 beginning at 12:20 am UTC.

0x5b24da735fd5835ec5afb5abf9f3e89270e609c8

The $2M withdrawn from the mixer was transferred to an intermediary address before consolidating with funds from other Lazarus Group thefts and deposited to exchanges. Comfort is gained the demix is accurate as the Paxful deposit address 0x246 links the Tornado Cash withdrawals to the deposits.

Paxful deposit address

0x246569f8b420c8d850c475c53d0d59973b3f08fc

October 2021 —  MGNR and PolyPlay Hack

MGNR hack incident summary

On October 8, 2021 the trading firm mgnr.io had $24M worth of assets drained from their wallets as the result of a private key compromise. In a deleted post on X (formerly Twitter) the team shared they had been targeted in a sophisticated cyber attack after receiving a Pantera Capital phishing email via SendGrid similarly to Ankitt Gaur from EasyFi. The team noted that private keys to hot wallets had been temporarily shared between multiple team members.

MGNR hack on-chain aspects

A blog post by the user CryptoCat in January 2022 revealed addresses from the theft by detailing mgnr.io wallets which sold Maple Finance tokens on October 8, 2021. The author mistakenly attributes the actions to the team instead of the hack.

MGNR hack October 2021 laundering

All assets from compromised mgnr.io wallets on EVM chains were bridged and swapped before being consolidated into 0x577 where the attacker deposited 4900 ETH from the incident to Tornado Cash beginning on October 8, 2021 at 4:37 am UTC and concluding on October 12, 2021 at 6:16 am UTC. Another address connected to the attacker deposited 210 ETH to Tornado Cash during this period.

A few days after 0xdef5 which received $4.3M from the EasyFi and Bondly hacks earlier in the year received 700 ETH from Tornado Cash.

0xdef57ccb20b1f2eaee0c64aab3280350f84cb0fc

Another address 0x1398 received 4500 ETH from Tornado Cash which previously had received $15.2M from the EasyFi and Bondly hacks earlier in the year.

0x1398db28ca00d9f943355d6b57ab28a61110bfef

While 1 X 100 ETH withdrawal is missing from the Tornado Cash demix for the 100 ETH pool there were no other withdrawals during that period which showed similar characteristics.

MGNR hack January 2022 laundering

On January 14, 2022 another 6 X 100 ETH and 5 X 10 ETH from an address connected to the theft was deposited to Tornado Cash. Just 24 hours later 4 X 100 ETH and 5 X 10 ETH was withdrawn to 0x964 before being transferred to 0x1398 further strengthening the demix due to the multiple denominations withdrawn over a sustained period of time.

Transfer laundered funds to P2P exchanges

Through a series of transactions, the funds sitting in 0xdef, 0x964, and 0xefdd were transferred through intermediary addresses and consolidate with funds from other Lazarus Group hacks such as EasyFi, Bondly, and the Nexus Mutual founder before USDT was deposited to the P2P marketplace Paxful beginning in July 2022. In April 2023 they began using Noones, another P2P marketplace. They continue slowly sending USDT in batches until November 2023.

Paxful deposit address

0x246569f8b420c8d850c475c53d0d59973b3f08fc

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

PolyPlay Incident Summary

October 28, 2021 in a series of transactions, multiple wallets controlled by the PolyPlay team saw unauthorized transfers of $1.6M indicating a private key compromise. In a deleted post on X (formerly Twitter) the PolyPlay team shared the wallet address of the attacker and a Binance listing phishing email they received.

On-chain aspects

Theft Address

0x0040c81b7de0953e5b9fc056700479cace1b7500

350 ETH from the incident was then deposited to Tornado Cash on November 8, 2021 and 320 ETH was withdrawn 90 minutes later to an address connected to other Lazarus Group hacks. Funds were later deposited to Paxful and Noones accounts.

Paxful deposit address:

0x246569f8b420c8d850c475c53d0d59973b3f08fc

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address:

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

November 2021 — bZx Hack

Incident Summary

On November 3, 2021 the lending protocol bZx had $55M drained on the BSC and Polygon deployments after a bZx developer fell victim to a phishing attack after running a script on his personal computer granting the malicious actor access to their private keys.

In a post mortem update the bZx core team shared that they worked with Kaspersky to analyze the incident and reached the conclusion it was likely Lazarus Group as their security team had analyzed prior attacks carried out by the group finding similarities in the tools and phishing email received.

On-chain aspects

A preliminary post-mortem published by the bZx team shared wallet addresses involved with the hack.

Theft addresses:

0x74487eed1e67f4787e8c0570e8d5d168a05254d4

0xafad9352eb6bcd085dd68268d353d0ed2571af89

0x0ACC0e5faA09Cb1976237c3a9aF3D3d4b2f35FA5

0x967bb571f0fc9ee79c892abf9f99233aa1737e31

0x6abcA33faeb7deb1E61220e31054f8d6Edacbc81

0x1ae8840ceaef6eec4da1b1e6e5fcf298800b46e6

Connections between theft addresses

The Bondly attacker was directly connected to the bZx hack from November 2021 as the 0xc43 theft address funded one of the addresses used by the bZx attacker on Polygon as well transferred funds on Ethereum to an intermediary address which received funds from another address involved in the bZx hack listed in the post-mortem blog post. Notably both attacks also share similar characteristics in the sense as the hacker gained access to a password and manipulated the protocols smart contracts after.

On-chain the incident is also connected to other hacks such as mgnr.io, Polyplay, Wonderhero and ANKR founder as dust leftover in theft addresses was swept to a single address in February 2022.

0x2d7554062664050294640891a122019a68ac5a2b

bZx hack laundering

Tornado Cash deposits:

• 8600 ETH from the theft was deposited to Tornado Cash from November 15–18, 2021 by 0x20d9

• 2360 ETH from the theft was deposited to Tornado Cash on December 13, 2021 by 0x20d9

Tornado Cash withdrawals:

• 4100 ETH likely from the theft was withdrawn to 0x7c6 from December 3–10, 2021.

  0xc7c6d42875fd091faa16ad0225f587158f47fce4

• 940 ETH likely from the theft was withdrawn to 0x683 on December 18, 2021

  0x683c3d42325ca1beb2475f443c916832f0bd10f2

• 1000 ETH likely from the theft was withdrawn to 0x785b on December 23, 2021.

Reviewed all Tornado withdrawals 400 ETH or more from November 15 — December 31, 2021 and no other withdrawals during this period shared similar characteristics of laundering patterns from other Lazarus Group thefts.

Post-Mix connections to theft addresses

While only a partial demix of 6,400 ETH from the hack comfort is gained as on-chain the Paxful deposit addresses 0x2465 and 0x593d are connected to Coinberry, CoinMetro, Nexus Mutual, FinNexus, PolyPlay, bZx hacks linking the original theft addresses from multiple incidents to the Tornado withdrawals.

August 2023 — Steadefi & CoinShift Hacks

Steadefi Incident summary

On August 7, 2023 the Steadedefi team made a post on X (formerly Twitter) informing the community its deployer wallet had been compromised and an attacker had transferred ownership of all lending and strategy vaults to an address the attacker controlled, allowing them to drain $1.2M of users assets.

A recent DPRK report published by the United Nations from March 2024 revealed a Steadefi team member had been in contact with someone on Telegram pretending to work at a fund named “Spirit Blockchain Group” where the attacker sent a malicious file disguised as a presentation for their investment fund which the Steadefi team member downloaded.

Steadefi On-Chain Aspects

In a post on X (formerly Twitter) the Steadefi team shared the wallet of the attacker.

Theft address

0x9cf71f2ff126b9743319b60d2d873f0e508810dc

Coinshift Incident Summary

While no public statements have been made about the incident, due to the sudden transfers of assets from multisig wallets tied to the founder on which were sold immediately August 16, 2023 it is likely the founder was a victim of a private key compromise.

Coinshift On-Chain Aspects

Theft address

0x979ec2af1aa190143d294b0bfc7ec35d169d845c

0x68c4a151d436ec1c5448d225a97bd19cce4dfed0

0xbcd5b968a79a04bf2bb942a449f10c20a7121ed8

0x4c7c2b39e3d642d452adfca632939a60b1baacf7

August 2023 Laundering

624.3 ETH was deposited to Tornado Cash by 0xe10d from the Steadefi hack in August 2023.

900 ETH was deposited to Tornado Cash by 0x68c4 from the Coinshift hack in August 2023.

Further evidence that the attacks were done by the entity is shown through the overlap between deposits made to the Tornado Cash 100 ETH pool within minutes of each other by the Steadefi and Coinshift attacker on August 23, 2023.

The table below shows 15 X 100 ETH deposited to the Tornado Cash 100 ETH pool from both incidents.

Within 24 hrs of the deposits to the Tornado Cash 100 ETH pool, matching amounts were withdrawn to three addresses and later consolidated to a single address on October 12, 2023.

0x5d65aeb2bd903bee822b7069c1c52de838f11bf8

Transfer laundered funds to P2P exchange accounts

Through a series of transactions, the funds sitting in 0x5d were converted to USDT, transferred through intermediary addresses and deposited to P2P marketplaces Paxful and Noones in November 2023. The Paxful deposit address 0x2465 has been reused for other Lazarus Group hacks such as EasyFi, Bondly, and Nexus Mutual.

Paxful deposit address

0x246569f8b420c8d850c475c53d0d59973b3f08fc

0x0258c2af4fe694df026cca55d17feebd5b361acc

0x3af55ab7edbca175f80f3a7ddeac5dabf611347b

Noones deposit address

0x4272200ef626d409e9bac681aa0efdb653a9ef0b

Paxful and Noones accounts receive $44M from Lazarus Group hacks through July 2022– November 2023

Paxful deposit address

$12.8M deposits from July 2022 — November 2023

0x246569f8b420c8d850c475c53d0d59973b3f08fc

$12.1M total deposits from January 2023 — November 2023

0x593dc5e1ad81667bbfc90739dd2c09c926920e3b

Noones deposit address

$14.3M total deposits from April 2023 — November 2023

0x2e1155cf5374cba058a04fd03ebd0ba19afe580d

November 25, 2023 Lazarus group began using new Paxful and Noones deposit addresses. Full list can be found here.

Converting $44M to fiat on P2P marketplaces Paxful and Noones

OSINT analysis was conducted and I identified two users which were active on Paxos and Noones and displayed trading volume consistent with the amount deposited from the hacks.

EasyGoatfish351

FairJunco470

The timing of activity on these accounts further matches the deposit. Very few other accounts on Paxful and Noones showed similar levels of trading volume. Taken together, it is very likely that these were the accounts being used.

Additionally, the hot wallet outflows for Noones and Paxful were analyzed and no matching crypto withdrawals of similar volumes were observed, indicating USDT was likely being exchanged for bank transfers or cash after deposits were made to the site.

Historically Lazarus Group has used Chinese OTC traders to convert crypto to fiat.

Results of the investigation

At the time of this article 374K USDT was blacklisted by Tether in November 2023 and an undisclosed amount was frozen at centralized exchanges in Q4 2023.

3 of 4 stablecoin issuers have blacklisted an additional $3.4M sitting in a group of addresses. This article will be updated after the 4th follows suit.

Other connected incidents

Exchange user hack — January 2021

Arthur0x hack — March 2022

Geracoin & Darshan hack — September & October 2022

Maverick Founder hack — October 2023

A special thanks to

• Taylor Monahan from Metamask

• Symbiotic from Binance Security Team

• Nick Bax from Five I’s

• Nick Carlsen from TRM Labs

• Binance Security Team

for their contributions and guidance with the investigation.

Since early 2022 Loyalist / Lukas / Shibango has stolen an estimated $4m+ worth of crypto and NFTs through running phishing scams on Twitter and by collaborating with other known phishing scammers.

July 2022

On July 25 2022 multiple people fell victim to an ENS domain phishing site prompting people to grant approvals to 0xe55 and lose 10 NFTs. This address had been freshly funded by 0x908 earlier that day. Prior to then 0x908 had deposited 100,000 DAI into Tornado Cash.

Stolen funds from 0xe55 were then swept to 0xc997. Connected to 0xe55 are numerous addresses who have fallen to victim to similar phishings scams.

Twitter user rugnft had BAYC 3273, BAKC, and Otherdeed stolen on July 30 2022 ending up in 0xc997 and 0x85d, two addresses seemingly controlled by Loyalist. Later that day 100 ETH was deposited into Tornado Cash by 0xc997.

August 2022

On Aug 1 2022 0xc997 funded a new address 0xa30 before then funding 0x572a on Aug 10 2022. From 0x572a 526 NFTs were stolen from various phishing scams.

EX 1: Twitter user buchetto phished for Meebit 8661 by 0x572a on Aug 13

EX 2: Twitter user StockDisick phished for 17 NFTs on Aug 15 by 0x572a

EX 3: Twitter user AJslays phished for 9 NFTs on Aug 15 by 0x572a

EX 4: Twitter user Jasoncooperpix phished for 5 NFTs on Aug 21

Discord

In August 2022 Loyalist became active in the Doodles Discord server with the username Shibango#8161 (ID: 819713798419251280)

Inside the server Loyalist revealed his Twitter account “Loyalist” along with the matching ENS address “loyalist.eth”

Doodle 6755 matched what was posted to Discord and his OpenSea profile.

Visiting loyalist.eth revealed the address was primarily funded by multiple large Tornado Cash withdrawals.

From earlier in this article it was revealed 0x908 had made a 100,000 DAI deposit into Tornado on July 18 2022 as well as a 100 ETH deposit on July 30 2022.

loyalist.eth coincidentally received 100,000 DAI from Tornado on July 20 2022. The 100,000 DAI pool typically doesn’t see much activity and has a small anonymity set.

Four hours after depositing on July 30, loyalist.eth then receives 100 ETH from Tornado.

Although this is promising it’s not yet conclusive so let’s continue digging.

September 2022

On Aug 13 0x572a funded a new address 0xaa18 which went on to steal 446 NFTs from various phishing scams.

EX 1: Twitter user Tutushik5 was phished for 10 NFTs on Sep 4 by 0xaa18

EX 2: Twitter user jfitz69420 was phished for 4 NFTs on Sep 4 by 0xaa18

EX 3: Twitter user Frank_theTnk was phished for 1 X MAYC and 3 X Otherdeed NFTs on Sep 5 by 0xaa18 after falling for a Otherside impersonator on Twitter that posted links to a phishing site.

EX 4: Twitter user CryptoKlopp was phished for 3 X Otherdeed NFTs on Sep 5 from the same Otherside phishing scam by 0xaa18.

EX 5: Twitter user ametaversea was phished for 5 NFTs on Sep 15 by 0xaa18

0xaa18 consolidated the stolen funds to 0xaf5c and made 2 X 100 ETH and 1 X 10 ETH deposits into Tornado beginning September 12 at 10:29 am UTC.

• Sep 12 at 8:07 pm UTC: 100 ETH was withdrawn from Tornado

• Sep 12 at 8:08 pm UTC: 10 ETH was withdrawn from Tornado

• Sep 13 at 2:09 pm UTC: 100 ETH was withdrawn from Tornado

  All three withdrawals were eventually moved to addresses tied directly to Loyalist once again.

October 2022

On Sep 15 0xaa18 funded 0x41cc before then funding 0x465 on Oct 10. From 0x465, 480 NFTs were stolen from various phishing scams. During this month Loyalist started actively using Monkey Drainer to steal NFTs.

EX 1: Twitter user greenmamba_eth was phished for 19 NFTs on Oct 10 by 0x465.

EX 2: Twitter user ursthiru was phished for MAYC, 2 X Meebits, Cool Cats, and 16 other NFTs on Oct 22 by a fake Blur Twitter account.

EX 3: Twitter user Blainetrain83 was phished for 17 NFTs on Oct 22 from the same fake Blur Twitter account by 0x465.

On Oct 22 funds were consolidated to 0x8fed before depositing 2 X 100 ETH to Tornado on Nov 3 2022 at 6:17 am UTC.

• Nov 4 at 3:13 am UTC: 100 ETH was withdrawn from Tornado

• Nov 4 at 3:15 am UTC: 100 ETH was withdrawn from Tornado

Once again the funds consolidate to to a loyalist address.

We now have seven instances of Tornado deposits and withdrawals tied directly to loyalist matching 1:1.

November 2022

On Nov 4 2022, 7 X CryptoPunks were phished using Monkey Drainer. Loyalist used 0x8fed to initially fund the main address tied to the phishing scam. It remains unclear what exact role he played in the attack.

Who is Loyalist

In the Doodles Discord server and on Twitter Loyalist reveals he is from Eastern Europe and even posts pictures of the country.

A reverse image search of the photo that Loyalist shared shows this is Kaunas, Lithuania.

Loyalist proceeds to show real estate listings on Discord from Lithuania.

The real estate website in the photo has a Lithuania domain.

In January 2023 it was revealed that 200 million Twitter users had their email addresses and other information leaked online as a result of an API issue from Q4 2021.

Searching the database revealed Loyalist’s personal email account along with the name of Lukas B. This info was also cross-referenced with other publicly available information.

• Email | Name | Screenname | Followers | Created At

• Email redacted | Loyalist.eth | loyalist | 175 | 2014-12-17

The email and other personal information has been redacted for privacy reasons but veracity has been confirmed and will be shared with victims and projects so legal action can be taken.

Conclusion

Currently the address loyalist.eth has been inactive since Oct 2022 but $1m DAI is currently held in his alt address 0xa13 which has made transfers in the past two weeks. His primary exchange account has seen $2.9m in total deposits on Ethereum. Based on these number it’s fair to estimate at least $4m has been stolen by Loyalist as a result of running phishing scams and any other illicit activity.

In total 1741 NFTs were found to have been stolen by Loyalist and 416 unique victims have been observed. Here are two graphs visualizing the number of thefts by collections and unique NFT phishing victim accounts per day.

This first graph by bax1337 shows the number of NFTs phished by collection. Collections with a floor price below 0.1 ETH as of 2-14-23 were omitted.

Loyalist’s activity was analyzed over a period of 7 months. This second graph by bax1337 shows the number of unique victims phished on each day he was active.

If you believe you were possibly a victim of Loyalist please search your address here.

Hopefully in the near future we will see legal action taken against Loyalist (Lukas) for everyone he has harmed. The recent announcement of a seizure by the US FBI from another phishing scammer is promising and leads to me believe it will liekly be one of many to come.

If you find research like this interesting or perhaps if you were a victim of Loyalist yourself please consider donating to my wallet address. My work is entirely community funded with countless hours going into articles such as this one.

ENS:

zachxbt.eth

For EVM compatible coins:

0x9D727911B54C455B0071A7B682FcF4Bc444B5596

Gitcoin:

buidlbox

Ongoing and upcoming hackathons. Every buidlers gateway into the digital frontier.

https://app.buidlbox.io

Since late 2021 a scammer known as Elliot / Chinese / Devil has stolen $5m+ worth of crypto and NFTs through phishing scams and a NFT rug pull project.

October 2021 — Crazy Lemur Club

On Oct 10 2021 the NFT collection Crazy Lemur Club (CLC) launched with a total supply of 5,000 NFTs created by the anonymous team “Cat” & “Dog”. CLC advertised utility such as “exclusive metaverse access, arcade games, and a community DAO” but on November 5 2021 CLC made its last Tweet ever with the website and Discord being shutdown.

In total CLC had made the team $320k (82 ETH) which was eventually transferred away from the deployers wallets to Tornado Cash. As of Oct 2022 some of the NFTs haven’t even been revealed.

In Nov 2021 the two anon founders got into an argument to where Dog changed the metadata to read “devil on Instagram Cat aka Chinese aka Elliot is a scammer do not deal with him, he will f you up and claim he’s a millionaire”.

One of the victims then proceeded to Tweet about it on Nov 7 2021.

One of the victims confronted Elliott / Devil on Instagram about the rug pull yet he shifted the blame to the other founder Dog and claimed it was simply “marketing” issues.

The funds eventually were all transferred away with no further communication from the team.

January 2022 Part 1

After the CLC rug pull Elliot began to focus on phishing NFTs by creating fake Sudoswap and NFT Trader websites. On January 4 2022 Elliot phished 2 BAYC NFTs from the victim cryptanosaurus.

How do we know it was Elliot? From a deleted Telegram account Elliot proceeded to brag about the attack by sharing a screenshot of his Metamask wallet with the stolen funds received.

0xE5Ed9358aDB278C60142E676c919dEE316786324

Address: 0xe5ed9358...316786324 | Etherscan

Address (EOA) | Balance: $1.37 across 1 Chain | Transactions: 34 | As at Oct-23-2025 06:16:39 PM (UTC)

https://etherscan.io

In case you aren’t convinced it was the same scammer here is the phishing attack mapped out in relation to the CLC rug. You can see some of the stolen funds eventually consolidate at 0xc027.

January 2022 Part 2

On January 14 2022 Elliot once again showed off his phishing attacks this time stealing multiple CloneX and various other NFTs using 0x9114, with the username “Matthew Stokey” on OpenSea.

If you search the 0x9114 address on Twitter you will see all of the victims from January 2022 complaining about that address. OpenSea has since banned the address .

If you map out the 0x9114 address you will see how it is directly tied to the CLC deployer before then consolidating at the 0xc027 address.

Here is another screenshot of what Elliot would see on Telegram when creating “trades” on the fake Sudoswap and NFT Trader sites.

Once again the address is 0xc02702c7A9BF7c8F33793aD6Ca44Bf2bd99f9369

February 2022

On Feb 1 Twitter user bo66ydigital was phished for 1 BAYC and 2 MAYC NFTs. Again the address used to scam was tied to both 0x9114 and 0xc027.

Bobby

@bo66ydigital

today I got hacked for my MAYC #1819, #7713 and my BAYC #4329. I am devastated and bought these in the last few months so they cost me a lot of money...any help, please report this, as I am lost. I cant believe how shady people can be & not think twice @opensea @BoredApeYC

7

10:51 PM • Feb 1, 2022

Tornado Deposits

With the stolen funds Elliot made many Tornado deposits in early 2022 from the various phishing scams. From the 0xc027 address 100 ETH was deposited into Tornado on January 29.

Shortly after on February 13, 400 ETH was moved from 0xc027 to 0x328f before being deposited into Tornado over the next few days. From 0x328f in total $1.25m (445 ETH) was sent to Tornado.

Other phishing scams are linked to Elliot from 0x328, 0xb2a8, 0x215, 0xb52, 0xa0e, 0x5c8, 0x0141 which have collectively deposited over $3.3m (1165 ETH) into Tornado from Jan 2022 — Apr 2022. Another 434 ETH sits in wallets that’ve been dormant for months.

0x0Poor aka Elliot

In February 2022 a mysterious new BAYC owner popped up on Twitter, Discord, and OpenSea who went by “0x0poor” using an address which had been almost entirely funded via Tornado Cash.

Interestingly just like for the Tornado deposits 0x0poor received 1 X 100 ETH withdrawal on January 29 and subsequently 4 x 100 ETH and 5 x 1 ETH in February from Tornado later matching the deposits shared above 1:1.

While he did not withdraw the exact amount to one single address immediately after depositing, Elliot instead later consolidated the Tornado withdrawals into his public address a few hops out in the weeks following a withdrawal.

The stolen funds were then used to buy a variety of NFTs. Elliot currently holds BAYC 6466 and 46 x 10k ENS domains in his portfolio.

0x0poor placed a 5 WETH offer on the ENS domain ‘elliot.eth’ in July 2022 further solidifying he is the same phishing scammer.

Using his BAYC profile picture I was able to match it to the Instagram user ‘$ex’.

Elliot would also share posts with the Instagram user ‘Nikola’ who appears to be his girlfriend. Notice how the roofing is the exact same as in Elliot’s Instagram story.

Elliot is quite active in the Bored Ape Yacht Club Discord with 55+ pages of messages (Discord ID: 920842415412224021). On May 29 Elliot posted that he was in Tenerlife at a villa.

His gf then posted a video at the same villa on Tiktok the next day.

Caught in 4k

@bestvideosofct

0x0poor - Phishing scammer pt 1

11

10:26 AM • Nov 1, 2022

She also would post tons of other videos with Elliot in the background and of her splurging on designer clothing or luxury travel presumably using the stolen funds.

Caught in 4k

@bestvideosofct

0x0poor / Elliot Pt 2

6

10:27 AM • Nov 1, 2022

Caught in 4k

@bestvideosofct

0x0poor/Elliot Pt 3

6

10:28 AM • Nov 1, 2022

In recent months Elliot appears to be a customer of the scammer ‘Monkey Drainer’. Last week I messaged MD on Telegram where a customer of MD accidentally then messed up. I temporarily added his username to my Twitter bio which was then flexed in the MD announcement channel minutes after.

Using the “Followed by Wayvern, jETHski.eth and 761 others you follow” I was also able to narrow the account down to Elliot. How might you ask? Well it turns out the Twitter user ‘itsWayvern’ only has 87 total followers with one of them being 0x0poor aka Elliot.

Once I had this I then checked to see if 0x0poor followed 0xjetski, which in fact he did. I then exported his following list to confirm the total number followed also matched the screenshot as well.

To check for any on-chain ties I started with the 0x0poor public wallet and mapped out the transactions to find that the wallet is only 2–3 hops away from Monkey drainer ENS and federalagent👮‍♂.eth . The 0xc027 Tornado deposit wallet from earlier in this article is also only a few hops away from Monkey Drainer’s main wallets proving Elliot is a customer.

It’s disgusting to see a phishing scammer steal millions in the span of a few months and then use it to buy designer clothing, NFTs, and travel around the world living lavishly. Hopefully now that it is known Elliot is behind many recent phishing scams the victims will be able to take some sort of legal action to potentially recover funds in the future.

A huge thanks goes out to Bisamazen who created the amazing cover photo for this article and also bax1337 who helped review some of the transactions I found.

Donations

If you find research such as this particularly interesting or perhaps if you were a victim of Elliot yourself please consider donating to my address. My work is entirely community funded with hundreds of hours going into articles such as this.

0x9D727911B54C455B0071A7B682FcF4Bc444B5596

zachxbt.eth

BTC:

bc1qw56fn670purjq5wvyr7w875q3h75hgkawnruy4lkxmx0ruapdj2ss03kw7

Gitcoin:

buidlbox

Ongoing and upcoming hackathons. Every buidlers gateway into the digital frontier.

https://app.buidlbox.io

Welcome to part 2 of tracking down the people responsible.

As a TLDR to those who missed the first part of the investigation, I uncovered that Cam (who previously SIM swapped $37m), sold Twitter panel access to scammers known as HZ & Popbob enabling them to hack 12+ NFT Twitter accounts.

Safe to say horror (HZ/Chase) was not too thrilled with my thread calling him out for the Twitter hacks.

Why would he ask to take them down?

Few remember that prior to the Twitter hacks HZ has been also responsible for the majority of Discord attacks working with Popbob and Two1

Back in April 2022 I mapped out their known wallets with over $3.9m in them at the time.

As of a few weeks ago HZ/Chase began flexing on Twitter an iced out Audemars Piguet watch.

Well where did he buy that watch?

I realized HZ likely paid in crypto due to the nature of how he obtained the funds.

I then asked around a few mutual friends who sell watches. This lead me to a watch seller who recently sold that AP watch for $47.5k USDC.

Inside the Discord server for the seller were two flex pics by the buyer (HZ) with the first made on 08/19/22.

What looks similar? Well the success pics inside the Discord from the buyer were the EXACT same watch and sweater as posted on Twitter by HZ.

I then chatted with the watch seller who was completely unaware of what had transpired. After learning what HZ has done they confirm it’s the same watch and have me look into the address HZ paid with.

0xdc25df861f979a175bfe4f3737d1562d45cdc5cd

Watch payment:

I then map out the flow of funds.

The address HZ used to pay the watch seller $47.5k was DIRECTLY funded by multiple addresses used to scam people with hacked Twitter accounts such as @deekaymotion @Zeneca_33 @ezu_xyz @JRNYclub

(highlighted in yellow below)

Just 1–2 hops away from this address HZ is tied to the @BoredApeYC @nansen_ai @AnataNFT @LACOSTE @TheParallaxHQ @cheebsnft Discord attacks and to @nounsdao @franklinisbored Twitter account hacks.

More attacks aren’t displayed for the sake of space.

On June 28 the JRNY Club Twitter was hacked.

In total HZ received 73.56 ETH ($114k) from the scam to the same address used to pay for the watch.

TXID:0x8879d3f03028954c406484ae818b59511d75c3eaaea8f815fe374db7aa387077

On July 14 DeekayMotion Twitter account was hacked.

In total HZ received 23.11 ETH ($36k) from the scam to the same address used to pay for the watch.

TXID:0x8bc3cdf25a31476f685aee8bd004868f90356a1219e0ae1879b9f353640ed379

On July 19 Zeneca’s Twitter was hacked.

In total HZ received 20.36 ETH ($31.7k) from the scam to the same address used to pay for the watch.

TXID:0x2ae1482e97f56c5e88a54e8457b4a1c6199341eb6deffe0fb4b865e474a5c375

(note HZ is tied to the 333 club Discord attack too)

Some of the Discord attacks like the BAYC Otherside and 333 Club ones HZ is tied to stole $300k+ worth of NFTs with each attack.

Since December 2021 @NFTherder has tracked at least 600 Discord servers that’ve been compromised (thanks for calculating this number).

Here is his latest report for August 2022:

okHOTSHOT

@NFTherder

73 #NFT discords have been exploited in August through social engineering including big projects like Llamaverse, PGodjira and Humanoids

Millions continue to be stolen. These are REAL crimes with real victims. Stay vigilant

128

8:05 AM • Sep 1, 2022

After months and months of tracking their group it’s nice to know one of the main perpetrators (Chase Senecal) for NFT/crypto phishing attacks has been identified. Others in his group like Popbob have yet to be caught

Hopefully at some point victims will take legal action

The majority of the stolen funds haven’t been spent & sit in wallets like:

$1.27m0x9971e3efc26ce470f806c725518e51dee118202e

$730k0x5f7a8e85071e992473a016529b86c6bf0c4e50a4

$828k0xe84d4e6451119f49f24f13caf13fbda331c2245f

Some is spent on OG usernames like @skull @horror

Sources:

Chainabuse report (am advisor):chainabuse.com/report/19be733…

Breadcrumbs report (am investor):breadcrumbs.app/reports/2851

Archive:archive.ph/BSBAW

Hundreds of hours go into reports like this. If you appreciate my research please consider donating to my wallet. All my work is possible because of it.

zachxbt.eth

0x9D727911B54C455B0071A7B682FcF4Bc444B5596

bc1qqsspeghy0wenywvgvrka3krqzd3gdvq38pmf4hka6llget8kjemquk23g6

On February 22, 2020 Josh Jones was sim swapped for ~60k BCH & 1547 BTC

BCH victim address qzumak2rvxksjgkjuxe2fe5jxatktlsnhy5sthr5p7

BTC victim address 1 bc1qd0hveqwqu9h3x8flfq560hlyk9mptf3j2p89gg

BTC victim address 2 bc1qrwhh74sv88gzq6qgpz5u55u00w2lqprw30ke94

Immediately following the attack the Redman laundered the 60k BCH with hundreds of transactions in small amounts to centralized exchanges (CEX). This chart visualizes the movement of the 60k BCH with the majority ending up at two exchanges.

With the 1547 BTC stolen, a small portion was sent to CEXs but the majority was deposited into both Chip Mixer and Crypto Mixer.

On Nov 17 2021 Hamilton Police (Ontario, CA) formally charged Redman for the attack after working with FBI & US Secret Service They seized $5.4m worth of crypto. The rest of the $31.5m still remains missing to this day (he was underage at the time).

Since May 2022 we’ve seen popular NFT Twitter accounts hacked such as

@beeple

@jenkinsthevalet

@nounsdao

@deekaymotion

@Zeneca_33

@frankdegods

@KeyboardMonkey3

@franklinisbored

& more The majority of these accounts all had 2FA on leaving people confused how this might happen.

The hacked Twitter accounts lead to millions of dollars worth of crypto stolen in total. This table shows a rough estimate for the amount of crypto stolen with each account above.

This lead to a post on the forum marketplace SWAPD by the user “Antihero” advertising a Twitter panel. The prices to use the panel varied from $30k to $300k paid in crypto.

On Twitter at July 29th 2022 antihero emerged with the name “Cam” on an account inactive for 14 yrs. On Instagram he obtained the same username too.

On Instagram Redman posted a selfie of himself posing in front of mirror and also outside of a shopping center.

I zoom in and then look up the location of “Sunway Dental” What do you know it happens to be in Missauga, ON very close to the Hamilton Police station in the city where he had been previously arrested in Nov 2021.

If you’re still not convinced here’s more messages of him referencing Canada. Prior to being charged for the SIM swap Redman had been also known by the aliases “Cream” “4k” “lucky” and for leaking unreleased Juice WRLD songs.

Here’s two more posts Cam/Antihero made on SWAPD. Another person refers to the seller for the panel as Cam. Archive: https://archive.ph/ABvZy

Remember in Tweet 9 Redman began to eventually resell access to the panel. On June 26 2022 Cam received a 230 ETH + 20 ETH payment for lifetime access to the Twitter panel.

0x0214ee97e9d828e1e6aa49a85b89982a7dceacc7

Just a few hours after the payment

@nounsdao

Twitter was hacked. The scammers address had direct exposure to the JRNY club Twitter hacker, Nansen discord attack, and other Discord attacks.

Who bought the Twitter panel access from Redman? Well it was the scammers known as HZ/Chase and Popbob. Here’s HZ flexing panel access to Serpent (a security researcher)

HZ + Popbob flexing Franklin and Deekay being hacked.

It’s still unclear as to how Redman gained access to the panel to make elevated requests & reset passwords. As of now it appears the method stopped working It’s wild someone can SIM swap a person for $37m, only return $5.4m, & go back to their old ways without serious jail time.

If you appreciate my research/work please consider donating to my address:

ZachXBT.ETH

0x9D727911B54C455B0071A7B682FcF4Bc444B5596

bc1qrshu8d42ffq3jtrmzmujmmlh6swpw22a0qqt07l5u60n5efgazhqm5e4nk

Background:

Over the past year we’ve seen scammers become more creative with new methods to phish people in Web 3. In this investigation we’ll breakdown how two phishing scammers from France defrauded people out of NFTs worth millions of dollars and the trail of breadcrumbs left behind leaving them exposed.

December 2021 — Victim 1

On December 13 2021, Twitter user Dilly Dilly was phished for Bored Ape Yacht Club (BAYC) #237 after clicking on a link shared by a verified member of the BAYC Discord and approving a transaction on a website that he was lead to believe would produce an animated version of his BAYC. Unfortunately, Dilly Dilly fell victim to a phishing scam: once he approved the transaction, his BAYC was moved out of his wallet and into the hands of a scammer.

Tweet made by Dilly Dilly

Phishing site

The scammer proceeded to sell the BAYC on OpenSea for 47 ETH ($178k) that same day.

The same scammer phished 2 MAYC & 1 Doodles as well from three additional victims.

On December 15 2021, the scammer made seven 10 ETH deposits and three 1 ETH deposits into Tornado from 0x935e5aa5b49bbab19350399b470a02260f6c935b

January 2022 — Victim 3

On January 2nd 2022, Twitter user Tumolo was phished for BAYC #6166 after messaging the same scammer on Twitter and approving a transaction on a similarly fraudulent BAYC animator website.

The scammer made several other attempts to defraud multiple BAYC owners on Twitter using the same phishing website scam. Here are a few of DMs people received..

Once Tumolo’s BAYC was transferred to the scammer, they immediately sold it for 74.5 WETH ($180k).

The scammer then proceeded to make seven 10 ETH deposits into Tornado Cash that same day.

Just between these five victims we’ve reached a total loss of $1.7m. While our breakdown identifies that the victims all fell prey to a similar phishing scam, we haven’t yet proven where the funds went or who was potentially behind it.

Things begin to get interesting…

While the scammer did make an attempt to hide their breadcrumb trail by depositing the stolen funds into Tornado Cash, they were not careful about covering their tracks when it came to withdrawing the funds from Tornado, so let’s break it down

Victim 1 — Dilly Dilly was scammed on December 13 2021 with seven 10 ETH deposits and three 1 ETH deposits made that same day into Tornado. On December 13 2021, seven 10 ETH withdrawals and three 1 ETH withdrawals were made from Tornado to mathys.eth.

Victim 2 — El Mono was scammed on January 5th 2022, and six 10 ETH deposits were made that same day into Tornado. On January 6 2022 six 10 ETH withdrawals were made from Tornado to mathys.eth.

Victim 3 — Tumolo was scammed on January 22 2022, and seven 10 ETH deposits were made that same day into Tornado. On January 24 2022, seven 10 ETH withdrawals were made from Tornado to mathys.eth.

mathys.eth then sent the funds ($1.09m) to Kraken, Bitpanda, and SideShift.

Who is mathys.eth?

After one of the first victims got scamed we reached out to ‘exyt’ on Instagram and were able to uncover they were likely French.

In March 2022 after BlackAppleArt was phished, we checked the source code for the BAYC animator phishing website and found the handle “mtscam”, which led us to Telegram user mtscam and this profile picture.

This ultimately lead me to the Twitter account ‘mtsgtb’ and Instagram account ‘wef’ ‘mthsl’

Screenshot taken in May 2022

Notice the gold ring and necklace match those seen in the Telegram profile picture. Even more damning, we uncovered multiple Tweets made by Mathys, in which he broadcasts selling crypto for cash in Paris, presumably with the stolen funds.

Paying with XMR for hotel

Mathys flexing 100 ETH from Tornado pt 1

Mathys flexing 100 ETH from Tornado pt 2

Mathys clearly hasn’t acted alone, so who else is involved? We took a look at a friend Mathys named Camille (Cam) who posts as ‘rxtkv’ on Twitter

Here’s a photo of Mathys and Camille together that was posted to Twitter (it has since been deleted).

In February of 2022, Camille posted a tweet showing off NFTs he owned. If we look up the NFTs on OpenSea we see they are owned by the address 0x5bb5180D8b84d754F56e2BC47Dc742d0f5Ac37FE.

The address that owns the NFTS Cam boasted about on Twitter just so happens to have been funded by the same address that was used for multiple phishing scams. Cam’s address also sent 12 ETH to the same address used to scam BlackAppleArt and Jason Stone.

The ‘mtscam’ Telegram username starts to make sense as a combination of the two names, Mathys and Camille.

On Twitter, Mathys and Camille reply to each other frequently, although both often delete their tweets.

While this covers just a few examples of stolen BAYC NFTs, there are others who have had their NFTs stolen by these same two individuals. If we revisit the Kraken deposit address, directly linked to it are four more addresses with 497 ETH+ ($851k) worth of crypto assets sitting in them. I suspect these funds are the result of phishing sites created for Azuki, Sudoswap, and Doodles.

Address: 0xaDa61767...FdDAcAeE3 | Etherscan

Address (EOA) | Balance: $84.6 across 1 Chain | Transactions: 462 | As at Oct-23-2025 06:00:08 PM (UTC)

https://etherscan.io

Address: 0x5Efb9d89...cEBc18469 | Etherscan

Address (EOA) | Balance: <$1 across 1 Chain | Transactions: 268 | As at Oct-23-2025 06:00:10 PM (UTC)

https://etherscan.io

de6ted.eth | Address: 0x9e0352e6...20e7ba120 | Etherscan

Address (EOA) | Balance: $270.27 across 1 Chain | Transactions: 51 | As at Oct-23-2025 06:00:12 PM (UTC)

https://etherscan.io

Address: 0xdb4d9081...fd63e612e | Etherscan

Address (EOA) | Balance: $2.12 across 1 Chain | Transactions: 10 | As at Oct-23-2025 06:00:14 PM (UTC)

https://etherscan.io

More phishing scams linked to the Kraken account deposit

So far, I’ve uncovered $2.5m+ worth of NFTs that have been scammed by both Mathys and Camille. Undoubtedly there is more to uncover, but there is only so much that can be tracked through Tornado Cash. Hopefully in the near future we will see some form of legal action taken against Mathys and Camille for the financial harm they have perpetrated on so many people.

INTRO

Jeffrey Huang, known online as Machi Big Brother, is a former Taiwanese-American musician and tech entrepreneur. What follows is an extensive overview of Jeff’s history in the crypto space, a brief synopsis of Formosa, his subsequent projects, the other players involved, and as always, the data to back it up.

Over the past year, ‘Machi Big Brother’ aka Jeff Huang has become well-known in the NFT space as one of the largest Bored Ape Yacht Club holders. Despite this, few know of his history in the crypto space.

BACKGROUND

Jeff Huang first received notoriety as a founding member of pop/rap trio L.A. Boyz, formed in 1991. Active in the early to late 90s, L.A. Boyz released 13 albums and rose to popularity in Asia before eventually disbanding in 1997.

After finding success with L.A. Boyz, Huang found repeated success with the formation of hip hop group Machi in 2003. MACHI Entertainment, a prolific Asian hip hop/rap record label and subsidiary of Warner Music Taiwan founded by Huang and cohorts was to follow. Eventually, Huang transitioned from the music business to the tech sector with the creation of 17 Media (M17). Founded in 2015, M17 grew to become one of the most popular live-streaming apps in Asia before later on successfully exiting.

In 2017, Huang began his foray into the crypto space with Mithril, the first in a string of projects with vivid team members and wild price fluctuations. Let’s dive in.

Project 1: Mithril

In late 2017, Huang founded Mithril, a decentralized social media platform aimed at directly rewarding content creators with its native token MITH. Mithril conducted a private token sale on February 21, 2018, 70% of the tokens sold unlocked at TGE in February 2018, with the remaining 30% unlocking over the next three months. In April of 2018 Mithril listed on the centralized exchange Bithumb. By May of 2018, MITH tokens were fully vested, and by then, represented 89% of the circulating supply, resulting in huge selling pressure.

Jeff Huang: “Mithril was supported by large asian whales such as Wang Sicong and was one of the most successful launches of 2017”

Project 2: Formosa

Beginning in early 2018, Huang worked as an advisor with George Hsieh, a Taiwanese politician, Czhang Lin, and Ryan Terribilini to build Formosa Financial, a treasury management platform built for blockchain companies. Formosa Financial held an angel round which closed the last week of April 2018, raising 22,000 ETH. A private sale round closed on May 31st which raised an additional 22,000 ETH. This accounted for 30% of the total token supply. In total, Formosa raised $23m USD (44,000 ETH). Notable investors included Binance, QCP Capital, Lemnis Cap, Block One, Mithril/Jeff Huang, Maicoin, Wilson Huang, Leo Cheng’s Syndicate, Blockstate, and Block One.

Investors were sold on the premise that FMF was on a fast track to receiving a top-tier CEX listing.

Excerpt from deleted Medium article

Trading for FMF went live in June 2018 on IDEX where it immediately plummeted. It wouldn’t list on centralized exchanges (IDCM, UEX) until September 2018.

Additionally, 17 Media was scheduled to IPO on the NYSE on June 7th 2018, but due to unspecified settlement issues with investors, the IPO launch was postponed after plans to raise 115m USD fell through. After Jeff took to Facebook to express his frustration, directing expletives at Citibank and Deutsche Bank, both of whom were involved with the IPO.

Three weeks after the FMF ICO, Formosa Financial took a turn for the worse when two withdrawals of 11,000 ETH each were made from the Formosa Financial treasury wallet on June 22nd 2018 through the help of Ryan Terribilini. Unbeknownst to investors, cofounder George Hsieh had acted as sole director of the company, pushing a share buyback through himself, executing on both sides.

Share buyback made on June 22nd 2018

Share buyback made on June 22nd 2018

Ethereum Transaction Hash: 0x98b3f5b7a0... | Etherscan

Transfer 11,000 ETH to 0x1BAF538D...5bA2fA4e2 | Success | Jun-22-2018 04:13:04 AM (UTC)

https://etherscan.io

Ethereum Transaction Hash: 0xdb8535dd37... | Etherscan

Transfer 11,000 ETH to 0xAfc71Fda...185A700b4 | Success | Jun-22-2018 04:33:50 AM (UTC)

https://etherscan.io

George Hsieh and Yalu Lin relinquished their formal roles leaving remaining co-founder Ryan Terribilini as CEO and Lorne Lantz as CTO.

FMF - Breadcrumbs

Formosa Financial

https://www.breadcrumbs.app

This chart displays the ETH inflows of angel/private round funds into the multisig before the two 11,000 ETH withdrawals were made on June 22, 2018.

On June 29th 2018, a transfer was made of 10,500 ETH to a Binance account. The veracity of the Binance account’s KYC is unknown at this time.

The other 11,000 ETH sat untouched in a wallet until transfers of 4980 ETH, 1997 ETH, 1,400 ETH, 500 ETH, 103 ETH were made to various Binance accounts in late June & early July. 2,000 ETH was sent to czhang.eth, and 20 ETH was allocated to an EOA wallet.

The question remains: Who do the Binance accounts and the wallets belong to? Let’s dig deeper and take a closer look at some of these ETH outflows!

1. 4980 ETH outflow made on 7/26–7/29 2018: Records show that this Binance account has frequent inflows from two sources: FTX and littlebang.eth

1a). If we look up the owner of littlebang.eth on OpenSea we see they have the username “Bun919tw”

b). A quick Google search reveals “bun919tw” is actually Bun Hsu, a Cream Finance core engineer (Cream is another Jeff Huang project.)

C.R.E.A.M. Project Update

C.R.E.A.M. Project Update It hasn't been a month since we launched our YOLO Alpha on August 3rd. As we review our progress in hitting $190-million TVL, we wanted to share with the community ...

https://medium.com

c). Bun Hsu’s Twitter profile picture is BAYC #7066, which was gifted to him by machibigbrother.eth (Jeff’s public wallet) for his contribution to another project.

https://opensea.io/assets/ethereum/0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d/7066

d). Bun Hsu happens to have traded multiple Jeff projects such as FMF, SWAG, CREAM, SQUID, MCX.

Why did an individual who was not on the Formosa Financial team receive 4980 ETH just 3 weeks after the ICO, trade tokens from other Jeff projects, and a BAYC from Jeff himself?

2. 2000 ETH outflow made on July 11th 2018: The blockchain shows that this transaction was received by czhang.eth (Czhang Lin). Lin held the role of advisor at Formosa Financial until June 22nd.

a). Three weeks after Czhang received the 2000 ETH, Czhang sent 150 ETH to his brother Yalu Lin (Formosa COO) on July 22nd 2018.

Once again why is an advisor & COO of Formosa Financial receiving money intended to build the project?

3. 1997 ETH outflow made on July 28th 2018: The only inflows to this Binance account are from harrisonhuang.eth, an account that has frequent interaction with w9g.eth (Wilson Huang), VP of engineering at Mithril, and the current founder of XY Finance and GalaXY Kats.

Wilson gifting NFT to Harrison

Harrison gifting MAYC to Wilson

a). A quick Twitter search of harrisonhuang.eth reveals what we can presume to be his Twitter account, since he tweeted out his ENS address as a reply to Wilson.

Link to Tweet

Harrison is not listed as a team member on the Formosa Financial whitepaper or website. Once again a pattern emerges of individuals not publicly associated with Formosa receiving project funds.

While Wilson and Harrison do share the same last name as Jeff they are not family members.

The remainder of the Binance accounts that received funds from Huang lead to dead ends; the accounts do not have any recent interactions with other external or personal addresses and transactions are only movements from CEX to CEX.

On July 26th 2018, Jeff and Mithril were accused of trying to cheat the Binance monthly Community Coin vote. A user named Lucky uncovered evidence showing that Mithril received over 80,000 votes which were funded solely by two to three addresses. The Community Coin vote functions thusly: 1 BNB is equal to 1 vote, with up to 500 BNB/votes allowable per account, so that one voter is able to receive a maximum of 500 votes by holding 500 BNB. In the rules however, Binance states that the creation of fake accounts is tantamount to distributing BNB en masse and resulting in automatic disqualification from the competition.

Jeff Huang maintains his stance that Mithril did not cheat during the community coin listing since they were later listed on Binance.

Mithril used the same address for the Formosa ICO which was closely linked to Formosa Binance withdrawals at the time, holding $8.6m worth worth of MITH. The chart below shows the wallet that transferred BNB in bulk received ETH for gas from the largest Mithril whale wallet at the time.

MITH Binance Community Coin Manipulation - Breadcrumbs

MITH Binance Community Coin Manipulation

https://www.breadcrumbs.app

Even more damning, the sizable amount of BNB that was used to cheat the Community Coin vote coincides within the day that Bun Hsu received 1980 ETH. In fact it was deposited to his Binance account just less than an hour prior to the vote.

In checking transactions on the chain, I found additional instances of BNB distributed in smaller amounts (500 BNB or less) to Binance accounts that coincide with the timeline in which FMF funds were stolen.

1a. 2000 ETH deposit to Bun Hsu Binance on July 28th at 3:25 am UTC

1b. 43.8k BNB withdrawal from Binance on July 28th at 4:43 am UTC (presumably Bun)

2a. 1994 ETH deposit to Harrison Huang Binance on July 28th at 7:08 am UTC

2b. 30k BNB withdrawal from Binance on July 28th at 7:28 am UTC

Once again, these addresses tie back to Mithril. It’s sad to see that this is where a portion of the Formosa Financial funds likely went.

Mithril “wins” the vote

POLY wins after Binance filter for “oddities”

Once again, this is what Formosa’s raised funds were intended for.

In the fall of 2018, token holders began to suspect something was off when communication with Huang, Czhang, and other key FMF team members grew increasingly distant, and no proper explanations or project updates were given. FMF continued to plummet and the sudden abandonment by key team members left the project in shambles.

Wash trading bots on IDCM

Project 3: Machi X

In October 2018, Jeff Huang and Leo Cheng launched Machi X, a social marketplace for intellectual property rights, however they struggled to receive funding due to the performance of Huang’s previous project Mithril and the Formosa incident.

Jeff Huang: “Machi X was funded by Mithril holders who got an airdrop. It was a pioneer in the space of selling music copyrights on-chain, but once it was clear there was no product market fit it was wound down”

Mithril was listed on Binance in November 2018, which coincided with team allocation unlocks. By then, MITH was down over 80%.

It wasn’t until over a year after launch that Formosa investors would finally be clued in to what allegedly happened with their funds. On August 12th 2019, Formosa investors received an anonymous email sharing 22,000 / 44,000 ETH had been moved from the Formosa Financial private sale wallet just three weeks after the 2018 ICO. Various internal documents attesting to this were attached to the email.

In this leaked audio from 2019, former CEO of Formosa Ryan Terribilini shares his side of the story of what happened even though Ryan held full control of the multisig and funds.

I reached out to multiple VC’s and angels who invested in the project to better understand why they didn’t pursue legal action. It mainly came down to the fact that Jeff and George were seen as powerful figures in Taiwan and the investors I spoke to were afraid of what might happen if they came forward. Others simply didn’t want to deal with the mess since what happened had taken place across multiple jurisdictions. All were in agreement that they just wanted to forget that this ever even happened in the first place.

Project 4: Cream Finance

In 2020 the crypto market began to heat up again. Jeff forked Compound Finance, a decentralized peer to peer lending platform, to create Cream Finance with Leo Cheng in early July of 2020. Bun Hsu, Jeremy Yang, and Stanley Yang were among Cream’s dev team advised by Compound. As of today, Cream Finance has been exploited multiple times for more than $192m. $100M+ has has been returned to those affected by the exploits to date.

Jeff Huang: Cream was left in the hands of a highly-respected team in 2020, prior to the two exploits on Aug and Oct 2021. I returned to steward the protocol in Feb 2022 and recovered funds for those impacted by the exploits.

Project 5: Wifey Finance

In August, Wifey Finance, a Yearn Finance fork, was created by an ‘anon team’, Machi, Leo Cheng, and Wilson Huang all happened to be among the first members of the Wifey Discord channel. Transaction records show that Wifey’s deployer sent funds to Wilson Huang multiple times. After four days, Wifey Finance was abandoned.

Jeff Huang says he had no involvement beyond chasing projects early.

Project 6: Swag Finance

Another project tied to Machi, Swag.live was an adult entertainment site that launched its governance token in early October of 2020. When Swag was quietly listed as collateral on Cream Finance, the lack of transparency surrounding the listing caused a fair amount of controversy on Crypto Twitter. Within a few weeks, the token was farmed, dumped, and delisted from Cream from lack of on-chain liquidity.

Doo | StableLab

@DooWanNam

And this was even worse as it was basically Cream Finance founders absuing their power (as he was their advisor) to have it as collateral without going through governance. Also, $SWAG ended up getting prosecuted in Taiwan. Should been a red flag to remove it.

8

12:04 AM • Jun 11, 2021

DEXTools

DEXTools, the gateway to DEFI, real-time charts, history and all token info from blockchain.

https://www.dextools.io

Swag delisted from Cream 1.5 months post token launch

Project 7: Mith Cash

On December 30th of 2020, Mithril was back with a new project: Mith Cash, a fork of Basis Cash protocol (an algorithmic stablecoin). Just days after launching, Mith Cash grew to $1b TVL before crashing violently as token holders cashed out their rewards. Mith Cash eventually suffered the same fate as Basis Cash. Similarly to other projects, the team was ‘anon’ and Jeff as an early buyer.

Jeff Huang says he lost money from Mith Cash

MITH Cash price today, MIC to USD live price, marketcap and chart | CoinMarketCap

The live MITH Cash price today is $0 USD with a 24-hour trading volume of $0 USD. We update our MIC to USD price in real-time.

https://coinmarketcap.com

Project 8: Typhoon Cash

Shortly after the crash and burn of Mith Cash, Jeff was back to buying projects with an anon team early again with Typhoon Cash, a Tornado Cash fork. At launch it had been quite clear that the development was sloppy at best. Anyone was able to stake in the anonymity pool and remain anonymous, however, staking in the pool was necessary in order to receive rewards. This meant that in order to receive rewards, your rewards deposit would be doxxed, rendering the concept of an anonymous coin worthless. Within weeks after farming began, the project was abandoned, leaving members of the Telegram and Discord channels screwed over.

Jeff Huang says he lost money from Typhoon Cash

Rewkang one of first five members in the Telegram

**Typhoon Cash vulnerability revealed by Avner and **verified by Nick

Example:

Ethereum Transaction Hash: 0x8b8e68ed2e... | Etherscan

Call Stake Withdraw Function By 0xD066c92d...Aaaa233CE on Typhoon.Cash: 100 ETH | Success | Jan-21-2021 11:17:28 AM (UTC)

https://etherscan.io

withdraw address is under “recipient”

unstake and withdraw from second address

No updates have been posted in the Discord, Telegram, or Twitter since February 2021 , leaving people screwed over.

Project 9: Mud Games

With the sudden rise in popularity of Loot for Adventurers (randomized in-game assets stored on-chain) at the end of August 2021, Jeff was soon involved with his own version called Heroes of Evermore, which quickly raised 533.92 ETH for the anon team. Unlike Loot, for Heroes of Evermore there were suspicions it was not randomized as insiders minted some of the rarest NFTs from the collection, unbeknownst to Evermore holders.

Jeff Huang says that he has not sold his NFTs and says that it was indeed randomized contrary to how it looked.

Both team members Jeff & penguin minted #2 and #3 for rarity of the collection

Project 10: Squid DAO

Once again, an ‘anon team’ was behind the launch of Squid DAO, an OHM/Nouns DAO fork that appeared in October of 2021. Among the early holders was MachiBigBrother.eth. By January 2022 the project was shut down at the suggestion of Machi with 60% of the funds returned back to investors.

https://vote.squid.xyz/#/

Nowadays Machi has moved onto X, XY Finance, and most recently, his newest fork: Ape Finance.

XY Finance Team & Advisors

X Advisors

In so many of projects linked to Jeff we see the same reoccurring themes play out: anon teams, forked projects, fresh wallets funded via FTX, and short lifecycles. We see the same players in every project, Wilson and/or Leo are always in the mix. VC’s like Andrew Kang even turn a blind eye. I reached out to Andrew in October 2021 and this is what he had to say:

Then in February, Andrew threw his support to Jeff again, even though at this point, Cream did not have much activity. It’s sad to see people turn a blind eye to obvious rugs when money is involved, especially when the parties involved have financially harmed others at significant cost.

I reached out to Jeff prior to the release of this article as a general courtesy. He reinforces he was just compensated for his advisor role at Formosa, claims he did not know of the 4980 ETH payment to Bun or Harrison, and he maintains that Mithril never cheated in the Community Coin competition. I believe that there are simply too many coincidences between all of these projects for this to be the case.

If you would like to support my research I accept tips:

zachxbt.eth

0x9D727911B54C455B0071A7B682FcF4Bc444B5596