Coinstats Exploiter Becomes Active in Laundering Stolen Funds After a Long Period of Inactivity

A previously dormant crypto exploiter of CoinStats came back to active laundering and transferring a large number of assets between the addresses and contracts according to the report by CertiK alerts. The event has caused concerns in the crypto space because the attacker involved used techniques to clean his/her coins and retain a large portion of the funds.

The exploiter was finally active on the 9th of November, moving around 2.6 million Dai (DAI) to four different addresses in what was the first major movement since no activity has been registered for months. After this transfer, an additional 2.6 million DAI was staked into the Maker sDAI contract the following day, which can be attributed as a proper application of DeFi protocols.

Surprisingly, the exploiter’s moves are approximated to half of the pooled total stolen assets. At the moment, a significant portion of the 3,027 ETH ($10 million) that were deposited in address 0x7397 still holds. Data from today shows that 2,600,000 DAI still sits in the address 0x7b00, while 762 ETH still remains in the 0x7d38 address, thus showing millions are still uncleaned.

Consequences and Security Conclusions for Users

This exploiter is back to business proving that there is always an exploit hanging around for vulnerable DeFi protocols and wallets holding significant cryptocurrency value. The users are encouraged to be compliant and keep an eye on the large and suspicious transactions, including the addresses, which have been previously compromised. 

As such exploitative techniques continue to change, crypto users and related platforms should take the necessary measures to prevent such attacks.