The ill-gotten crypto from one of the industry’s largest exploits is on the move again, with on-chain data showing another $46 million of stolen funds has just shifted from the hacker’s wallet.
The Wormhole attack was the third-largest crypto hack in 2022, resulting from an exploit of Wormhole’s token bridge in February 2022. Around $321 million of Wrapped ETH (wETH) was stolen.
According to blockchain security firm PeckShield, the hacker’s associated wallet has become active once again, moving $46 million worth of crypto assets.
This was made up of around 24,400 Lido Finance-wrapped Ethereum staking token (wstETH), worth approximately $41.4 million, and 3,000 Rocket Pool Ethereum staking token (rETH), worth about $5 million, which was moved to MakerDAO.
The hacker appears to be seeking yield or arbitrage opportunities on their stolen loot as the assets were exchanged for 16.6 million DAI, PeckShield reported.
The MakerDAO stablecoin was then used to buy 9,750 ETH priced at around $1,537 and 1,000 stETH. These were then wrapped back into 9,700 wstETH.
#PeckShieldAlert The Wormhole Network Exploiter 0x629e supplied $46M worth of cryptos, including 24.4k $wstETH ($41.4M) & 3k $rETH (~$5M), to MakerDAO for 16.6M $DAI & used them to buy 9.75k $ETH ($ETH at $1,537) & 1k $stETH ($ETH at $1,543), then wrapped them for ~9.7k $wstETH pic.twitter.com/BRfygHgpit
— PeckShieldAlert (@PeckShieldAlert) February 12, 2023
On Feb. 10, an on-chain sleuth observed that the hacker was “buying the dip.”
However, the price of Ether (ETH) has since fallen below those levels over the past few hours. At the time of writing, ETH was down 2.6% on the day at $1,505, according to CoinGecko.
At the time of the transfers, stETH prices depegged from Ethereum and climbed as high as $1,570. At time of writing, they were trading 2.4% higher than ETH at $1,541. Furthermore, wstETH also had depegged and risen to $1,676, 11.3% higher than the underlying asset.
Related: Crypto exploit losses in January see nearly 93% year-on-year decline
The latest funds movement comes only a few weeks after the hacker moved another $155 million worth of Ethereum to a decentralized exchange.
On Jan. 24, 95,630 ETH was sent to the OpenOcean DEX and then subsequently converted into ETH-pegged assets, including Lido’s stETH and wstETH.