Hacker Returns Majority of Stolen Funds in Surprising Move

In an unexpected turn of events, the perpetrator behind the 79thVault hot wallet exploit has returned a significant portion of the stolen assets. According to data from blockchain security firm PeckShield, the attacker sent 15,000 BNB, valued at approximately $11 million, to a wallet address designated by the project team.

The Initial Breach and Suspicious Transfers

The security incident originally involved a hot wallet on the BNB Chain, operated under the name 79thVault. It is suspected that private key compromise led to the breach, resulting in an estimated loss of $12.5 million. This wallet was typically used only for small, routine transfers to a rewards pool.

Prior to the exploit, unusual activity was detected. The wallet address executed seven separate transfers, moving a total of 2.01 million 79AU tokens from a trading pair to external addresses. The individual transfer amounts varied, with some as high as 500,000 tokens, signaling a departure from its normal operational pattern.

Unanswered Questions and Ongoing Developments

Before the major restitution, the attacker had conducted a smaller test transaction, depositing 30 BNB to the KuCoin exchange. The purpose of this move remains unclear.

The situation still presents several unresolved issues:

  • Remaining Funds: With about $1.5 million of the initial $12.5 million haul still unaccounted for, the whereabouts of this balance is a key point of interest.
  • Motivation for Return: The voluntary return of most of the stolen cryptocurrency is unusual. Potential reasons could range from pressure from law enforcement and private negotiations with the project to the hacker's own strategic calculations.
  • Root Cause: A thorough investigation is needed to determine how the private keys were compromised—whether through internal error, a phishing attack, or a technical vulnerability.

This case underscores the persistent security challenges in the crypto ecosystem, particularly for hot wallets connected to the internet. It highlights the critical need for robust security practices, including the use of hardware wallets, multi-signature protocols, and regular security audits for both projects and individual users.