Hackers Move Ethereum Stolen From Upbit

By Kapil Gauhar

A popular Korean cryptocurrency exchange, Upbit lost $50 million worth of Ethereum (ETH) in November from the exchange hot wallet in a seeming hack. However, the details o the cyber attack remain sparse yet some think that it was an inside job as the word ‘hack’ wasn’t mentioned and owing to the timing of the loss of funds. Still, Upbit claimed to reimburse all users affected the corporate funds.

In spite of this, the stolen Ethereum (ETH) is still out in the wild. And, as indicated by blockchain analysis, after some weeks of silence to apparently fly under the radar, the hackers are commencing to move the funds this time again, while potentially creating a catalyst for some downward price action in the Ethereum market.

Stolen Ethereum is Moving

Whale Alert, a popular Twitter account, which is dedicated to tracking suspicious blockchain transactions, posted a tweet on Saturday. In its tweet, the account notified that the 5,000 ETH, valued at around $660,000 at the time of writing this post, was transferred from a wallet that is operated by those involved in the Upbit hack to an unknown wallet.

However, this may look negligible, but the analysis of the transactions as well as related addresses found that this single transfer is more sinister than this might look on the surface.

The analysis using Ethereum blockchain explorer, Etherscan, found that parts (in smaller batches of 25, 50, 100 coins) of the 5,000 Ethereum are being stolen into newly-created wallet addresses, which send funds to cryptocurrency exchange wallets in turn.

By far, we have found that some of Upbit’s siphoned funds are being transferred to at least 3 exchanges including Binance, Bibox, and one more yet to be identified.

Still, there remain millions of dollars worth of Ethereum (ETH) related to the hack in non-exchange wallets, which makes it likely that the hackers are still waiting for the right time to send those funds to cryptocurrency exchanges in a bid to cash out their booty.