Investigation into Coincheck's Hack, Potential Bitfinex Involvement? Blockchain Analysis Details Inside

As most know, a significant amount of NEM tokens ($XEM) were hacked from Japanese exchange, Coincheck, last year, in which $530 million were extracted from the exchange.

The NEM was never recovered. However, it is traceable to a certain extent.

Later that year, it was discovered that a darkweb site had been set up to facilitate the exchange of NEM tokens for Bitcoin in an anonymous fashion (see source).

Below is one of the transactions associated in connection with this service:

https://www.blockchain.com/btc/tx/18cb6d0679a19b31b6f2f321088111ba2ee1a22d03ca170d85a96751dba94fa3

Diving Down the Rabbithole

We’re going to start with the most recent link cited above, which has the transaction ID: 18cb6d0679a19b31b6f2f321088111ba2ee1a22d03ca170d85a96751dba94fa3

The majority of funds from the transaction (which has numerous inputs), can be seen heading directly to 1PQV39VVwfDnwY7W5JPReGFRiMnfJupWFg.

Checking the Affiliated Cluster

The address above is grouped in this cluster: https://www.walletexplorer.com/wallet/044c1db3e953a5a2/addresses

Crystal Blockchain Software confirms this clustering as well.

Notably, that cluster also contains the affiliated address: 18C35bBJxeXw8eUgDruc7Jo7p488wF4WKE

CoinMarket.com Connection

18C35bBJxeXw8eUgDruc7Jo7p488wF4WKE = Coinmarket (or attached to it)

User claims that it is part of their “final exit scam”

Experiences with CoinsMarkets.com?

Experiences with CoinsMarkets.com?bitcointalk.to‘Coinsmarkets’ is a defunct exchange that essentially extracted all user funds from the site at some point in 2017. Throughout 2018, they feigned solvency for a while before collapsing.

Notably, this 18C35 prefix address also has funds coming from 1AauwKcsQKmL6idtxp64Trv97N5cVrCDTn , which is attached to the original cluster containing Bitcoin that was swapped with hacked NEM coins.

Visualizing the Cluster

Thankfully, because of access to Crystal Blockchain Software, we can gain more information about the cluster address that the stolen bitcoins were attached to.

The metrics for the cluster address are displayed above in detail. However, we’re going to dig a bit deeper than that and see if we can find out more about the source of the bitcoins going into this cluster address.

In order to do so, we will track the highlighted transaction above, which sent the majority (14.1k bitcoins) of the bitcoins into the current cluster we are looking at.

Intro to Cluster #2

This cluster is our ‘source cluster’ address.

Below are pictures of the metrics and connections associated with this cluster.

The above does not necessarily implicate the exchanges listed, but it does give us a better idea of where funds were being sent from if those crypto exchanges wanted to take any action on those accounts.

Proceeding Forth to the Visualization

Now that we have a solid grasp of how the main cluster address was formulated, let’s see if we can track the distribution of funds via Crystal Blockchain’s visualization methods.

Tracking through, we can see a significant amount of illicit funds ended up at Bitfinex in one way or another.

One address that received a particularly large portion of funds is the deposit address 3HfYLED57Pd2pniUxEqUp7LX4sDo1aeos3.

Perhaps what is even more interesting is the fact that the majority of these funds ended up directly at Bitfinex’s cold wallet address. This can be seen in this transaction: d841ee94cee5c07f85d84cd50b9fd823d780e673a77ba81df4741293d0129fbd

Exchanges Where Funds Landed

Based on research, funds ended up at:

  1. Bitfinex
  2. OKex
  3. Kraken
  4. Localbitcoins
  5. Huobi
  6. Binance
  7. Gemini

Below are some pictures that show the intricacies in the routing of funds:

Concluding Notes

This most alarming discovery in the passage of wallets is that it appears that Bitfinex as an exchange was involved, in some facet, in the redirection of some of these funds.

This is stated because numerous deposit addresses (determined via their activity) were seen also sending funds out to various addresses. This is extremely unusual behavior for a true deposit address and it also indicates, definitively, that this redirection was done on behalf of the exchange.

Notably, not all Bitfinex deposit addresses function in this manner. In fact, the vast majority (98%+) simply send funds directly to the hot wallet address and on nearly no occasions are they sending funds directly to the cold wallet address, which is what we saw with transaction d841ee94cee5c07f85d84cd50b9fd823d780e673a77ba81df4741293d0129fbd.

It also notable that Bitfinex appears to be the central point of the transferred funds.

Get Free Email Updates!

*Action* Enter Best Email to Get Trending Crypto News & Bitcoin Market Updates

I will never give away, trade or sell your email address. You can unsubscribe at any time.

[Alert] Use the author's self-conducted information at your own risk, do you own research, never invest more than you are willing to lose.

[Disclosure] The published news and content on BitcoinExchangeGuide should never be used or taken as financial investment advice. Understand trading cryptocurrencies is a very high-risk activity which can result in significant losses. Editorial Policy \\ Investment Disclaimer

LEAVE A REPLY

Please enter your comment!
Please enter your name here

3,467FansLike
2,795FollowersFollow
4,230FollowersFollow

Live Bitcoin Price & Latest BTC Charts

Today's Latest Crypto News

Compound Protocol to Roll Out Decentralized Oracles Dubbed ‘Open Price Feed'

Compound, one of the most popular defi protocol, is all set to introduce open price feeds for lending on its platform using a decentralized...

$2 Million Slippage & Surge in Ether Price on Uniswap Helps Net $40k in Profit

A Uniswap user was able to profit $40,000 thanks to $2 million of slippage and the price of Ether surging north of 15%. It all...

Irish Govt to Target Cryptocurrencies Use in Money Laundering And Terror Financing

The Irish government aims to implement stricter and more stringent laws to curb money laundering and terrorism financing in its financial system, including digital...

Interactive Brokers to Settle $38 Million in Penalties for Violating AML Procedures

Interactive Brokers LLC, a U.S based brokerage that skyrocketed between 2013 and 2018, has agreed to settle a total of $38 million with the...

Ethereum Gas Price Hasn’t Been This High Since its Launch

The price of Ether is back to making its way to $400 level as it hovers around $391 in the green with just $840...

BitcoinExchangeGuide is a hyper-active daily crypto news portal with care in cultivating the cryptocurrency culture with community contributors who help rewrite the bold future of blockchain finance. Subscribe on Google News, see the mission, authors, editorial links policy, investment disclaimer, privacy policy. Got News? Contact us, we are human too. Note: nothing here is financial advice, do your own research thoroughly.

Start Using Crypto Today