Leading blockchain security company Peckshield has reported that two Bitmart wallets were hacked and stolen tokens were exchanged for ETH via 1inch’s DEX aggregator.
Hackers gained access to two BitMart hot wallets — an ETH wallet and a BSC wallet. The rest of the BitMart hot wallets are unaffected, and withdrawals have been suspended till further notice while BitMart conducts a security review. Although the hack type is unknown, BitMart expects losses to be in the £113 million range.
The withdrawals were not unusual, according to BitMart’s official Telegram channel, but the company eventually confirmed the attack via the CEO’s Twitter. The breach sent BitMart’s native exchange token tumbling in the ensuing 24 hours, falling 9.7% to £0.24.
According to Peckshield, losses have been understated. The security firm estimates the losses to be in the neighbourhood of £148 million, with roughly £75.5 million gone from the ETH wallet and £72.5 million lost on Binance Smart Chain. BabyDoge, BETU, BNB BPAY, BSC-USD, CMCX, EnergyX, FLNS, FLOKI, GMEX, GMR, HERO, JULb, MOONSHOT, SAFEMOON, SPE, STACK, STARSHIP, X2P, and ZOE are among the BSC assets that have been impacted. The hacker stole cash from hot wallets and traded them for ETH via the DEX aggregator 1inch, according to Peckshield’s investigation into the attack.
The funds were thereafter passed through Tornado Cash, an Ethereum decentralised mixer technology that masks the path that tokens take from source to destination. The mixer mixes funds from several users, making it difficult to tell the amount of crypto transacted, who made the transaction, and where the funds went.
It would be beneficial if other cryptocurrency exchanges were made aware of substantial deposits made through the Tornado Cash platform. Huobi has stated on Twitter that it is eager to assist in identifying inflows related to the breach.