$8 Million Nexus Mutual Hacker Lives in Singapore, Says Team

The attacker who stole more than $8 million worth of NXM from Hugh Karp has cashed out a significant portion of his stash. Nexus Mutual has identified many clues pointing to a potential suspect. 

Nexus Mutual Hacker Dumping Stolen Funds

In a year full of flash loan attacks, hacks, and so-called “rug pulls,” yesterday’s theft involving the Nexus Mutual founder was one of the most shocking in recent memory. 

The high-level attack involved setting up a fraudulent transaction to imitate the popular browser extension Metamask. It resulted in Karp losing 370,000 NXM, the native token of his cover protocol Nexus Mutual. The transaction can be viewed on Etherscan. 

The assailant has since begun moving the funds into other cryptocurrencies.

First, they exchanged a portion of them into ETH, followed by renBTC. There’s now over 137 BTC sitting in two addresses suspected to belong to the hacker. The BTC supply is worth $2,654,000 at the time of writing. Etherscan has a trail of many of their footprints; there’s still almost 200,000 wNXM, for instance, now worth $3,332,671, sitting in the wallet. 

Karp offered the attacker a $300,000 bounty for the funds’ safe return yesterday and has since alluded to escalating the case if the situation doesn’t change. 

Attacker.

The mempool is a dark forest, but the IPs on the internet are quite transparent.

I’m still happy to honour the bounty if you return the funds (less the bounty) within the next 12 hours. No questions asked.

— Hugh Karp 🐢 (@HughKarp) December 14, 2020

Potential Clues Unearthed

Though the Nexus Mutual protocol was unaffected by the incident, the team has been busy investigating. 

On Twitter, a team member confirmed that the attacker was a member of Nexus Mutual.

The protocol requires users to complete a KYC process when they sign up. The team says that they completed the process before switching their membership on Dec. 3. 

Nexus Mutual has since identified some possible addresses linked to the hacker. If correct, it appears the attacker may have made several clumsy slip-ups that have helped expose them.

There’s also been some suspicious activity in the official Nexus Mutual Telegram group, involving someone who began asking questions about the hack and blocked Nexus Mutual as a contact when the team reached out to them privately. Additionally, one of the addresses Nexus Mutual has unearthed has recently interacted with the one that stole Karp’s NXM.

The team says it belongs to someone who completed the KYC process and lives in Singapore. They’ve even located an IP address.

With the attacker still at large, the investigation is ongoing. 

Disclaimer: At the time of writing, the author of this feature owned wNXM and ETH, among a number of other cryptocurrencies.