Hacker Moves Millions from KyberSwap Attack Between Blockchains

A recent development in the wake of the KyberSwap hack shows that the hacker responsible is actively moving millions of dollars in digital assets between blockchains. According to a report from blockchain analytics firm PeckShield on February 26, the attacker transferred a significant amount of Ethereum and stablecoins.

Nearly 800 Ethereum moved

The data shows that 798.8 Ethereum, with an estimated value of almost $2.5 million, was transferred from the Arbitrum network to the Ethereum network. In addition, almost $1 million is worth of stablecoins moved; a wallet linked to the hacker transferred $826,500 worth of Dai stablecoins to another wallet.

The attack on KyberSwap, a decentralized exchange (DEX), is considered one of the largest digital heists of 2023. On November 23, KyberSwap alerted the community to a “security incident” and advised to evacuate any funds. It was initially estimated that approximately $46 million in digital assets had been stolen, but later calculations revised the total loss to almost $49 million.

In a remarkable twist, the hacker left a message for the KyberSwap team, announcing that negotiations could start once he was “fully rested.” In response, KyberSwap offered a $4.6 million bounty for the return of 90% of the stolen funds. However, negotiations took a turn when the hacker expressed dissatisfaction with KyberSwap’s approach, threatening to further delay talks if the team continued with legal threats and what he described as unfriendliness.

Situation eventually escalated

Ultimately, the situation escalated further when the hacker demanded full control over KyberSwap and all its assets, including temporary authority over KyberDAO, Kyber’s governance mechanism. He gave the company until December 10, 2023 to respond to his demands, otherwise the deal would be off.

As a result of the hack and the hacker’s subsequent demands, KyberSwap announced it would provide treasury grants to the hack’s victims. On December 2, 2023, the team announced that it would pay out grants to those who had suffered financial losses from the operation and had not yet been reimbursed. The consequences of the hack were far-reaching, forcing the company to fire half of its staff a month after operation.