Hacker returns half of assets stolen from NFT XCarnival

The attacker, who stole $3.8 million worth of ether, agreed to return half of the assets on the condition that the company would not contact the police.

Blockchain security expert and ZenGo co-founder Tala Beeri tweeted that an unknown hacker has returned half of the stolen assets to the NFT XCarnival crypto lending platform. In response, the platform team promised not to contact law enforcement agencies and cybersecurity specialists.

“The hacker accepted the offer and returned half of the funds to XCarnival_Lab. Episodes of negotiations between the victim and the attacker are visible in the blockchain! Including an offer that has increased from the original $300,000 to $1.8 million,” Beeri wrote.

The NFT XCarnival project, which offers users assets secured by non-fungible tokens, was hacked on June 26. As a result of a cyberattack, the attacker withdrew $3.8 million in Ether from the platform. Beeri explained that the hacker exploited a vulnerability that allowed multiple borrowings against the same NFT collateral.

Initially, the hacker deposited the Bored Ape #5110 token as collateral for the loan. The token used as collateral had to be locked by the protocol until the loan was repaid. However, thanks to the exploit, the hacker was able to withdraw the Bored Ape collateral without repaying the loan and using these funds to obtain another loan. The action was performed several times, as a result of which 3,087 ethers were removed from the protocol.

The NFT XCarnival team originally offered a $300,000 reward in exchange for stolen funds. XCarnival then increased its offer to half the amount stolen. The hacker agreed and returned the agreed amount to the site.

At the time of publication, 1,500 ETH ($1.8 million) remained in the wallet of an unknown person. The 120 ETH that was withdrawn via Tornado Cash to use the exploit has been returned.

At the beginning of the month, the developers of Optimism accidentally handed over 20 million OP tokens to hackers, which were intended for the market maker Wintermute. The hackers decided to return most of the funds.

Source: Bits

You may also like

TOP-3 AIRDROP this week
Top News
David

TOP-3 AIRDROP this week

This week three projects at once – Bluefin, Nexus and Infinex – are launched by Airrods to reward the participants