The cybercriminal associated with the infamous Uranium Finance hack has orchestrated a substantial transfer of funds, moving $2.5 million worth of Binance USD (BUSD) from the BNB chain to Ethereum. This incident was first flagged by PeckShield Alert, a reputable on-chain analytics firm, on January 22.
Utilizing the capabilities of the Li.fi protocol, a decentralized exchange (DEX) aggregator, the attacker converted their illicit gains into 812 Ethereum (ETH) alongside roughly half a million dollars in various stablecoins. The origins of these funds trace back to the Uranium Finance hack of April 2021, with the primary address linked to the breach moving a total of $3.1 million in BUSD to the Ethereum network.
Initial reports by Peck Shield pointed to a $10,000 BUSD transaction via Stargate, another cross-chain bridging solution. Further investigation uncovered additional transfers, cumulatively amounting to $3.1 million BUSD. The hacker employed a methodical approach, distributing $500,000 BUSD across six transactions, followed by another set of transactions totaling $100,000 BUSD, all executed within a single hour.
The flurry of transactions sparked widespread discussion among crypto enthusiasts and experts. At the time of the transfers, the exploiter’s BNB Chain address held over $15 million in various crypto assets, including BUSD and Wrapped BNB (WBNB). Subsequent to the transactions, the wallet was completely emptied of its contents.
Examination of the Ethereum address associated with the attacker revealed holdings of 824 Ether, valued at $1.3 million, along with smaller amounts of USDC and USDT. Notably, following the BUSD transfer, 1,200 ETH—worth approximately $1.89 million—were laundered through Tornado Cash, a cryptocurrency mixing service, in 12 separate transactions of 100 ETH each.
This pattern of transferring funds to Tornado Cash has been recurrent, with previous instances traced back throughout the year. In March, an unrelated address was used to move 2,250 ETH to the mixing service. In total, the hacker siphoned off $50 million in cryptocurrencies by exploiting a vulnerability in the Uranium Finance protocol’s pair contracts.
Moreover, the year 2024 has seen a surge in illegal cryptocurrency operations. A significant phishing scam detected by Scam Sniffer caused a loss of $4.20 million, manipulating ERC20 Permit signatures to gain unauthorized access to a victim’s funds.
English