A crypto hacker who stole tens of millions of dollars from the decentralized crypto perpetuals exchange GMX (GMX) is turning white hat by returning the stolen funds to collect a bounty.

In a new thread on the social media platform X, GMX says the hacker who stole $42 million worth of crypto assets earlier this week from its Arbitrum (ARB)-based liquidity pool is returning the funds and collecting a $5 million reward.

“A potential exploitable amount of $42 million belonging to GLP holders was secured. After payment of a $5 million bounty to the user, the remaining funds are now safely in the GMX Security Multisig.

Contributors are working on a proposed distribution plan for presentation to the GMX DAO (decentralized autonomous organization) and will share more information shortly.”

According to previous reports, the hacker struck on July 9th and transferred part of the funds to an unknown wallet. At the time, GMX said the exploit was limited to GMXV1 and that V2, its markets and liquidity pools, as well as the ecosystem’s native asset, were unaffected.

In its report on the incident, GMX says the exploit was a re-entrancy attack, or a type of hack that affects smart contracts by taking advantage of a vulnerability presented when a smart contract makes a call to another before updating itself, leaving open the possibility for an external malicious contract to enter in.

News of the returned fund sent GMX skyrocketing, as the digital asset is trading for $13.36 at time of writing, an 18.4% increase during the last 24 hours.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

A Chinese national was arrested in Milan, Italy, last week for allegedly being linked to the state-sponsored Silk Typhoon hacking group, which responsible for cyberattacks against American organizations and government agencies.

According to Italian media ANSA, the 33-year-old man, Xu Zewei, was arrested at Milan’s Malpensa Airport on July 3rd after arriving on a flight from China. Italian police arrested the suspect on an international warrant from the U.S. government.

ANSA reports that Xu is accused of being linked to the Chinese state-sponsored Silk Typhoon hacking group, aka Hafnium, which has been responsible for a wide range of cyberespionage attacks against the U.S. and other countries.

In particular, Italian media reports that Xu is linked to the 2020 Silk Typhoon cyberattacks on infectious disease researchers and healthcare organizations, which aimed to steal data on anti-COVID vaccines.

“These actors have been observed attempting to identify and illicitly obtain valuable intellectual property (IP) and public health data related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research,” read the joint advisory.

The hacking group has also been linked to more recent cyberespionage campaigns, including those on the U.S. Treasury’s Office of Foreign Assets Control (OFAC) and the Committee on Foreign Investment.

In March, Microsoft reported that Silk Typhoon had begun targeting remote management tools and cloud services in supply chain attacks to gain access to downstream customers’ networks.

Xu is currently being held in Busto Arsizio prison with the U.S. seeking extradition to face trial in the States.

If you know anything about a crypto hack, you’ve probably heard of the Lazarus Group.

They’re pretty much the final boss of crypto cybercrime – a North Korean state-backed hacking group responsible for some of the biggest thefts in the industry, including the Bybit hack earlier this year.

They’ve always carried this boogeyman of blockchain, mysterious vibe. But a new BitMEX report pulled back the curtain a bit.

And turns out… they’re not as flawless as some might think.

Over time, Lazarus seems to have split into smaller teams, and not all of them are equally skilled. Some are pros. Others – not so much.

Case in point: a BitMEX employee got a message on LinkedIn about joining a crypto project.

If you’ve followed Lazarus’ past scams, you know this is something they’ve done before – so the employee flagged it to the security team.

They were sent a GitHub repo with a Next.js/React project that – surprise – contained malware.

The attacker wanted them to run the code locally, which would’ve let malicious scripts execute on the employee’s computer.

Now, here’s what BitMEX found in the code:

• It used JavaScript’s eval() function, which takes a piece of text and treats it like code. So if it says “delete everything,” your computer will actually try to run that command – and that opens the door for attackers to sneak in harmful code;

• The malware tried to connect to suspicious URLs to download even more code – the kind of infrastructure Lazarus has used before in past attacks;

• It collected data like usernames, IP addresses, operating systems, and uploaded all of it to… wait for it… a public Supabase database

Yes. Public.

This is like using Google Sheets to store stolen data… and then leaving the spreadsheet unlocked.

The BitMEX team took a look and found nearly 900 logs from infected machines.

And in one of them, they caught a big oopsie: a hacker forgot to turn on their VPN and exposed their real location in Jiaxing, China.

Instead of treating this oopsie as a one-off discovery, BitMEX saw an opportunity here – they built a tool to keep checking the database.

This lets BitMEX:

• Track new infections as they happen;

• Figure out who’s being targeted – devs, exchange workers, or random users;

• Watch for repeat mistakes by the hackers (like more IP leaks);

• Potentially map out patterns – like locations, time zones, or organizational targets.

Lazarus is still dangerous – no doubt about it.

But the more we learn about their tricks (and their mistakes), the easier it becomes to protect people from falling for them.

The Sui (SUI) community appears poised to greenlight a recovery plan to return $162 million worth of crypto stolen from the decentralized exchange Cetus Protocol last week.

Last week, a hacker hit Cetus with a sophisticated smart contract exploit targeting the decentralized exchange’s (DEX) concentrated liquidity market maker (CLMM) pools, purloining approximately $223 million worth of assets from the platform.

The DEX quickly froze $162 million worth of the stolen assets. Now, the Sui community is currently voting on a proposal that enables a special transaction to return those frozen assets from two attacker addresses back to Cetus.

If passed, the vote would approve a one-time authentication of two special transactions hard-coded with the two attacker addresses, stolen asset objects, and their destination.

The votes are weighted by validator stake, but the Sui Foundation’s stake is excluded to maintain neutrality. The vote passes if more than 50% of the total stake participates and there are more “yes” votes than “no” votes.

The voting period ends next week, but early passing could happen as early as Thursday if the remaining unvoted stake cannot change the outcome. That appears poised to happen, with 71% of the validators having already voted “yes” at time of writing, compared to 0.3% for “no,” 1.5% abstaining and 27.2% who had yet to vote.

Cetus also announced this week that it is in a position to fully cover the remaining losses via cash, token treasuries and a loan from the Sui Foundation, pending the vote’s passage.

“Because full recovery is dependent upon the results of the community vote, we humbly ask for the Sui community’s full support to recover the funds via the upcoming vote. We recognize that this is an extraordinary ask forced by our actions, however we think it is the right decision especially for those affected.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney