Blockchain investigator ZachXBT uncovered the purported perpetrator behind the PrismaFi breach, which resulted in the protocol losing $11.1 million worth of cryptocurrency. Through a series of posts, ZachXBT disclosed that the individual behind the attack, identified as 0x77 (or Trung), may be connected to several other breaches.
The Prisma team initially detected a sequence of transactions on the MigrateTroveZap contract in March, ultimately resulting in a loss of 3,257 ETH (equivalent to $11.1 million at the time). Initially, the attacker communicated with the Prisma deployer, claiming the attack was a white-hat initiative. However, all funds were subsequently transferred to Tornado Cash, a sanctioned cryptocurrency mixer.
The attacker then made audacious demands, including a $3.8 million (34%) white-hat bounty, significantly higher than the industry standard of 10%, as noted by ZachXBT, who highlighted that this demand was essentially extortion, given the insufficient assets in the treasury to reimburse users.
Further investigation revealed that the attacker’s address received funds via FixedFloat and was subsequently traced to Arbitrum, a layer-2 solution on Ethereum. By analyzing timing, ZachXBT determined that the attacker’s address was linked to withdrawals on TRON, including those from the Bybit cryptocurrency exchange.
The investigation also unveiled connections to prior breaches, such as the Arcade_xyz breach from March 2023 and the Pine Protocol breach from February of the current year. The attacker, utilizing the alias 0x77 on Telegram, remained active and had ties to the deployer of @modulusprotocol, further solidifying the connection between each incident.
Furthermore, the investigator disclosed conducting an analysis of the attacker’s personal information, including phone numbers and emails, which indicated a proficient technical background. All collected personal data has been forwarded to the Prisma team, who are pursuing legal action against the hacker in Vietnam and Australia, ZachXBT added.
Source: crypto.news
