{"id":69546,"date":"2024-01-22T17:42:46","date_gmt":"2024-01-22T21:42:46","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=69546"},"modified":"2024-01-22T17:44:56","modified_gmt":"2024-01-22T21:44:56","slug":"uranium-finance-hacker-transfers-2-5m-busd","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/uranium-finance-hacker-transfers-2-5m-busd\/","title":{"rendered":"Uranium Finance Hacker Transfers $2.5m BUSD"},"content":{"rendered":"\n<p>Using Li.fi, the attacker from Uranium Finance moved 2.5 million BUSD from the <a href=\"https:\/\/coinscreed.com\/staging\/bnb-chain-unveils-greenfield-roadmap-targets-mass-adoption.html\" target=\"_blank\" rel=\"noreferrer noopener\">BNB chain<\/a> to Ethereum (ETH).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615-1024x576.jpg\" alt=\"Uranium Finance Hacker Transfers $2.5m BUSD\" class=\"wp-image-69547\" srcset=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615-1024x576.jpg 1024w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615-300x169.jpg 300w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615-768x432.jpg 768w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615-750x422.jpg 750w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615-1140x641.jpg 1140w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615.jpg 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Uranium Finance Hacker Transfers $2.5m BUSD<\/figcaption><\/figure>\n\n\n\n<p>Using the DEX aggregator Li.fi protocol, 2.5 million BUSD were transferred from the BNB Chain to Ethereum on January 22, according to the on-chain analytics platform PeckShield Alert. Assets were converted into 812 ETH and around $500,000 in stablecoins for this transaction.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-twitter\"><blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">#PeckShieldAlert<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><g id=\"wpil-svg-outbound-7-icon-path\" fill=\"none\" clip-path=\"url(#clip0_31_188)\">\r\n                            <path d=\"M9.16724 14.8891L20.1672 3.88908\" stroke-linecap=\"round\"\/>\r\n                            <path d=\"M13.4497 3.53554L20.5208 3.53554L20.5208 10.6066\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>\r\n                            <path d=\"M17.5 13.5L17.5 16.26C17.5 17.4179 17.5 17.9968 17.2675 18.4359C17.0799 18.7902 16.7902 19.0799 16.4359 19.2675C15.9968 19.5 15.4179 19.5 14.26 19.5L7.74 19.5C6.58213 19.5 6.0032 19.5 5.56414 19.2675C5.20983 19.0799 4.92007 18.7902 4.73247 18.4359C4.5 17.9968 4.5 17.4179 4.5 16.26L4.5 9.74C4.5 8.58213 4.5 8.0032 4.73247 7.56414C4.92007 7.20983 5.20982 6.92007 5.56414 6.73247C6.0032 6.5 6.58213 6.5 7.74 6.5L11 6.5\" stroke-linecap=\"round\"\/>\r\n                        <\/g>\r\n                        <defs>\r\n                            <clipPath id=\"clip0_31_188\">\r\n                                <rect fill=\"white\" height=\"24\" width=\"24\"\/>\r\n                            <\/clipPath>\r\n                        <\/defs><\/svg><\/span><\/a> <a href=\"https:\/\/twitter.com\/hashtag\/UraniumFinance?src=hash&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">#UraniumFinance<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> Exploiter- labeled address has bridged 2.5M <a href=\"https:\/\/twitter.com\/search?q=%24BUSD&src=ctag&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">$BUSD<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> from <a href=\"https:\/\/twitter.com\/hashtag\/BNBChain?src=hash&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">#BNBChain<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> to <a href=\"https:\/\/twitter.com\/hashtag\/Ethereum?src=hash&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">#Ethereum<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> via Li[.]fi<br>The Ethereum address has received 812 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&src=ctag&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">$ETH<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> and ~$505.5K in stablecoin <a href=\"https:\/\/t.co\/EZXZwJYTxK\" target=\"_blank\">pic.twitter.com\/EZXZwJYTxK<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/p>&mdash; PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1749324083698024491?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">January 22, 2024<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/div><\/figure>\n\n\n\n<p>The main address linked to the incident stemmed from the infamous Uranium Finance heist in April 2021, which moved $3.1 million in Bitcoin to Ethereum. <\/p>\n\n\n\n<p>Peck Shield's original report revealed the movement of $10,000 <a href=\"https:\/\/www.google.com\/search?q=Uranium+Finance+Hacker+Transfers+%242.5m+BUSD&rlz=1C1JJTC_enNG1049NG1049&sourceid=chrome&ie=UTF-8\" target=\"_blank\" rel=\"noreferrer noopener\">BUSD via Stargate<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a>, a cross-chain bridging mechanism. Additional transfers totaling 3.1 million BUSD were found through further tracing.<\/p>\n\n\n\n<p>The attacker\u2019s strategy involved distributing 500,000 BUSD across six transactions and 100,000 BUSD in another. The batch of transactions, executed within an hour, sparked discussions in the crypto community.<\/p>\n\n\n\n<p>The assets under the exploiter's BNB Chain address exceeded $15 million and included both BUSD and Wrapped BNB (WBNB). The wallet was empty as of the time of writing.<\/p>\n\n\n\n<p>Furthermore, the exploiter's Ethereum address displayed assets of 824 Ether, estimated to be worth $1.3 million at the time, in addition to lesser amounts of USDC and USDT. <\/p>\n\n\n\n<p>Notably, 1,200 ETH\u2014worth $1.89 million\u2014were transferred to <a href=\"https:\/\/coinscreed.com\/staging\/tornado-cash-co-founder-released-on-bail-lawyer.html\" target=\"_blank\" rel=\"noreferrer noopener\">Tornado Cash<\/a>, a cryptocurrency mixer, not long after BUSD was transferred to Ethereum. This was done in 12 transactions, each involving 100 ETH.<\/p>\n\n\n\n<p>These actions fit into a trend that was noticed all year, including multiple transfers to Tornado Cash in the months before. The first happened in March and involved moving 2,250 ETH to the mixer using a new address. <\/p>\n\n\n\n<p>By taking advantage of a weakness in the protocol's pair contracts, the exploiter could withdraw $50 million in cryptocurrency assets in total. On a related note, there have been more<a href=\"https:\/\/coinscreed.com\/staging\/report-shows-scammers-use-tether-usdt-for-illegal-activities.html\" target=\"_blank\" rel=\"noreferrer noopener\"> illegal cryptocurrency activities<\/a> in 2024. <\/p>\n\n\n\n<p>According to Scam Sniffer, a prominent phishing assault cost the victim $4.20 million. The con used ERC20 Permit signatures to its advantage, giving the con artists access to the victim's assets.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Using Li.fi, the attacker from Uranium Finance moved 2.5 million BUSD from the BNB chain to Ethereum (ETH). Using the DEX aggregator Li.fi protocol, 2.5 million BUSD were transferred from the BNB Chain to Ethereum on January 22, according to the on-chain analytics platform PeckShield Alert. Assets were converted into 812 ETH and around $500,000 [&hellip;]<\/p>\n","protected":false},"author":43,"featured_media":69547,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[12002,18008],"class_list":["post-69546","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-hacks","tag-uranium-finance"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/croc_1705958421615.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/69546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=69546"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/69546\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/69547"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=69546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=69546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=69546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}