- Start of the Attack
- Main Stage of the Theft
- After the Theft
In a meticulously planned social engineering attack, three hackers stole $243 million in cryptocurrency from a single individual. The investigation into the incident is ongoing.
Start of the Attack
The attack kicked off on August 19, when hackers, using spoofed numbers and fake support calls, posed as representatives from Google and Gemini. They tricked the victim into resetting their two-factor authentication (2FA) and transferring funds from their Gemini account to a compromised wallet. Additionally, the hackers gained access to the victim's private Bitcoin keys via AnyDesk, a remote desktop software, during a screen-sharing session.
Main Stage of the Theft
The first major Bitcoin transaction occurred at 1:48 am GMT, with 59.34 BTC transferred. Shortly thereafter, another 14.88 BTC was moved at 2:30 am. The largest part of the theft occurred at 4:05 am UTC, involving the transfer of 4064 BTC, worth $238 million at the time. The hackers celebrated their success by splitting the stolen funds and moving them through more than 15 different cryptocurrency exchanges. The money was transferred between Bitcoin, Litecoin, Ethereum, and Monero to complicate tracing efforts.
After the Theft
Despite the hackers' attempts to cover their tracks, the investigation led to multiple arrests and the freezing of significant amounts of funds. Wiz, one of the main participants, made a critical mistake by revealing his real name during a screen-sharing session. This helped investigators identify him and his accomplices. The funds were found in various cryptocurrency wallets, and some have already been returned to the victim. Joint efforts led to the identification and arrest of hackers, including Greavys, Box, and others.
The investigation into the $243 million cryptocurrency theft is ongoing, and law enforcement efforts are yielding significant results. Further arrests and fund recoveries are expected.
