Nexus Mutual Hacker Now Demanding $2.7 Million Ethereum Ransom
Despite an on-going investigation by Nexus Mutual and 1inch Exchange, the hacker is still at large. Now he’s raising the stakes.
Key Takeaways
- On Dec. 14, the Nexus Mutual founder was hacked for $8 million NXM tokens.
- The KYC-documents, Reddit conversations, and IP tracking unearthed a few clues, but the attacker has been unaffected.
- Meanwhile, the hacker has laundered nearly $3.2 million and now demands another $2.7 million for the remaining wNXM tokens.
Share this article
The Nexus Mutual hacker sent a direct message to Hugh Karp’s Ethereum address this morning, demanding 4,500 ETH worth ($2.7 million) in exchange for the remaining loot.
Nexus Mutual Hacker Unloads on DEXes
The price of Nexus Mutual’s NXM tokens has dropped 15% since the hack. The perpetrator now intends to wait for price recovery before unloading the rest.
While waiting, the hacker has asked the Nexus Mutual founder, Hugh Karp, for a $1.7 settlement to return the remaining loot.
Immediately after the incident on Monday, the attacker converted the KYC-ed NXM tokens to Wrapped NXM (wNXM) on Ethereum, using decentralized exchanges 1inch and Matcha.
Later, the perpetrator laundered $2.7 million, converting wNXM to 137 renBTC stored in two addresses.
During the 12-hour deadline, Hugh Karp placed on the entity to either return the funds for a $300k bounty or face legal consequences.
The attacker has displayed a total disregard for Karp’s threats.
Brave or Stupid?
Today, the assailant converted another $500,000 wNXM into Ethereum and has paused for price recovery before unloading more. The attacker used Tornado Cash, a privacy tool for masking Ethereum transactions, and 1inch exchange to convert wNXM to ETH.
The leftover wNXM tokens, worth nearly $4.5 million, are still at the hacker’s disposal.
The hacker is messaging Hugh directly on-chain and asking 4.5k ETH in return of the remaining wNXM. That's ~$2.7M that Hugh needs to pay to rescue wNXM and a nice "token swap" from the vermin to exit this illiquid market into good cash ETHhttps://t.co/dWOIAxWlyU https://t.co/o8Pmm3gwg2 pic.twitter.com/8PnteEYYzv
— Julien Bouteloup (@bneiluj) December 16, 2020
So far, the hacker’s KYC documents on Nexus Mutual have revealed a location in Singapore. The IP address, nonetheless, tracked a Japanese site.
Despite the sophistication in carrying out the attack, the attacker seems to have made a few clumsy mistakes, making them vulnerable to IP address tracking. However, it is also possible that the hacker is using a VPN service to mislead investigators.
The audacity of the hacker doesn’t indicate any fear of getting caught.
Share this article
