Prisma Finance hacker could be uncovered after investigations by on-chain analyst

The Prisma attacker has connections with previous hacks in two web3 protocols.
Attacker initially claimed the attack to be a "white-hat rescue" before depositing the stolen funds to sanctioned mixer Tornado Cash.
The Prisma team has begun leveraging legal avenues in Vietnam and Australia to apprehend the attacker.

In an X post on Tuesday, popular on-chain analyst @ZachXBT revealed key information that could lead to the potential apprehension of the attacker who hacked Prisma Finance on March 28.

Prisma attacker’s offer to return stolen assets

On March 28, DeFi protocol Prisma Finance suffered an attack on one of its smart contracts, resulting in a loss of 3257 ETH worth $11.1 million at the time. Prisma Finance, which claims to be a liquid staking token-powered stablecoin solution, immediately halted its protocol after the hack, ordering users to revoke access to the smart contract.

The attacker initially enquired about returning the funds through a series of on-chain messages, claiming the hack to be a "white-hat rescue."

Also read: DEX hacker sentenced to three years in prison after stealing $12 million worth of cryptocurrency

A white-hat hacker acts ethically by finding vulnerabilities in computer code and reporting them to the owners. However, in the crypto space, grey-hat hackers search for vulnerabilities, exploit them, and ask for bounties before returning the funds.

3/ At first the attacker communicated with the Prisma deployer the attack was whitehat.

Later that day all of the funds were deposited to Tornado Cash contradicting that statement.

The exploiter began making outrageous demands and asked for a $3.8M (34%) whitehat bounty

This… pic.twitter.com/vFdJCJM5mz
— ZachXBT (@zachxbt) April 16, 2024

Investigations provide a ray of hope for Prisma

An investigation by @ZachXBT revealed that the attacker leveraged an Arbitrum address, Tron address, and Bybit.

The same attacker was connected to hacks in Pine Protocol earlier, at the beginning of the year, and Arcade_xyz last year.

@ZachXBT's further investigation revealed the hacker's potential name to be "Trung" with the X account @Ox77wn

9/ Further analysis was conducted with the phone number, emails, and other details of the alleged exploiter.
From their posts on X it is clear they have a strong technical background.

As of now all personal details have been compiled and the Prisma team is pursuing every… pic.twitter.com/GvQIbXbxdG
— ZachXBT (@zachxbt) April 16, 2024

Prisma resumed operation on April 6 after it claimed to have carried out a security audit.

This comes after a convicted decentralized exchange hacker was sentenced to 3 years in prison after stealing $12 million worth of crypto assets.

Crypto attacks and rug pulls in Q1 2024 reached about $336.3 million, according to bug bounty platform ImmuneFi.

Share: Cryptos feed

Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.

If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.

FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.

The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.