Connect with us

Hi, what are you looking for?

ELEVENEWS

Ethereum

Nexus Mutual Hacker Now Demanding $2.7 Million Ethereum Ransom

Despite an on-going investigation by Nexus Mutual and 1inch Exchange, the hacker is still at large. Now he’s raising the stakes.

Key Takeaways

  • On Dec. 14, the Nexus Mutual founder was hacked for $8 million NXM tokens.
  • The KYC-documents, Reddit conversations, and IP tracking unearthed a few clues, but the attacker has been unaffected.
  • Meanwhile, the hacker has laundered nearly $3.2 million and now demands another $2.7 million for the remaining wNXM tokens.

Nexus Mutual Hacker Unloads on DEXes

The price of Nexus Mutual’s NXM tokens has dropped 15% since the hack. The perpetrator now intends to wait for price recovery before unloading the rest.

Wrapped Nexus Mutual (wNXM) price chart. Source: CoinGecko
Wrapped Nexus Mutual (wNXM) price chart. Source: CoinGecko

While waiting, the hacker has asked the Nexus Mutual founder, Hugh Karp, for a $1.7 settlement to return the remaining loot.

Immediately after the incident on Monday, the attacker converted the KYC-ed NXM tokens to Wrapped NXM (wNXM) on Ethereum, using decentralized exchanges 1inch and Matcha.



Later, the perpetrator laundered $2.7 million, converting wNXM to 137 renBTC stored in two addresses.

During the 12-hour deadline, Hugh Karp placed on the entity to either return the funds for a $300k bounty or face legal consequences.

The attacker has displayed a total disregard for Karp’s threats.

Brave or Stupid?

Today, the assailant converted another $500,000 wNXM into Ethereum and has paused for price recovery before unloading more. The attacker used Tornado Cash, a privacy tool for masking Ethereum transactions, and 1inch exchange to convert wNXM to ETH.

The leftover wNXM tokens, worth nearly $4.5 million, are still at the hacker’s disposal.

So far, the hacker’s KYC documents on Nexus Mutual have revealed a location in Singapore. The IP address, nonetheless, tracked a Japanese site.

Despite the sophistication in carrying out the attack, the attacker seems to have made a few clumsy mistakes, making them vulnerable to IP address tracking. However, it is also possible that the hacker is using a VPN service to mislead investigators.

The audacity of the hacker doesn’t indicate any fear of getting caught.

News Source

Advertisement
Advertisement

Copyright © ELEVENEWS