The Stake.com Hack Explained: Unpacking the $41M Crypto Breach

Initial Indicators

This hack’s swift and strategic nature suggests a potential compromise of Stake’s hot wallet private keys. However, as of this writing, there hasn’t been an official confirmation from Stake.com’s team regarding this.

Sequence of Attacks

Ethereum Network Breach

Within moments, a massive $15.7M was siphoned off from the Ethereum Network. The crypto assets targeted included:

• 6001 $ETH
• 3.9M $USDT
• 1.1 $USDC
• 900K $DAI

These were quickly funneled to hacker-controlled address 0x3130662aece32f05753d00a7b95c0444150bcd3c, which subsequently distributed them to various Externally Owned Accounts (EOAs).

Binance Smart Chain & Polygon Networks Breach

Roughly an hour later, the attacker struck again, this time targeting both the Binance Smart Chain and the Polygon Networks. A total of $25.2M in assets were drained:

From BSC:

• 12k $BNB
• 7.35M $BSC-USD

And others including 1.8M USDC, 2100 $ETH, 1.3M $BUSD, 83.9B $SHIB, 40K $LINK, and 300K $MATIC. All the assets were immediately sent to this address 0x4464e91002c63a623a8a218bd5dd1f041b61ec04 and distributed to different EOAs.

From Polygon:

• 70K $DAI
• 4.22M $USDT
• 1.78M $USDC
• 3.25M $MATIC

The assets were sent to this address 0xfe3f568d58919b14aff72bd3f14e6f55bec6c4e0 and distributed between multiple accounts.

Stake’s Response

Shockingly, it took five hours after the initial attack for the Stake.com team to acknowledge the breach publicly, assuring users that their funds remained secure. Interestingly, a mere few hours prior, users were notified of a system maintenance.

The Aftermath

Two days after the attack, the attacker commenced laundering the stolen assets, predominantly by bridging them from Polygon to Avalanche, eventually converting a substantial portion of MATIC to BTC. To date, 72 BTC have been laundered, with the remaining assets still seemingly in the attacker’s possession.

A Potential North Korean Connection?

Recent information from the FBI points towards a more sinister plot. The attack signatures and the addresses involved seem eerily similar to those seen in other significant 2023 hacks, including those of Alphapo, CoinsPaid, and Atomic Wallet. These hacks collectively resulted in losses surpassing $200M. Preliminary investigations suggest that North Korean hackers might be the culprits behind this series of high-profile breaches.

Follow @hackenclub on ? (Twitter)

Conclusion

The Stake.com hack serves as a stark reminder of the evolving threats in the crypto domain. Continuous vigilance, robust security measures, and proactive incident response mechanisms are paramount in ensuring the safety of digital assets.