Multichain Attacker Withdraws Additional $117 Million, Fueling Concerns

The Multichain attacker has withdrawn an additional $117 million worth of multiple assets, including DAI, wrapped Bitcoin, and Ethereum tokens.

The Multichain attack is far from over, as the exploiter of the cross-chain platform recently withdrew an additional $117 million four days after taking out $125 million worth of assets from the protocol. 

According to a recent disclosure from Chinese blockchain reporter Colin Wu, the latest series of outflows occurred over 12 hours earlier today. 

In the past 12 hours, Multichain experienced a large number of abnormal outflows again, and all the abnormal outflow assets were basically transferred to the new address: 0x1e…477b, worth about 117 million US dollars.

11.91m DAI, 13,146 ETH, 10.1m USDC, 64m USDT, 52 BTC…

— Wu Blockchain (@WuBlockchain) July 11, 2023

On-chain data suggests that the affected tokens include stablecoins such as USDT, USDC, and DAI, as well as wrapped versions of Bitcoin and Ethereum. The outflows came from several networks, including Ethereum, Arbitrum, Avalanche, BNB Chain, Fantom, Cronos, and Optimism.

Wu disclosed that the attacker withdrew 209,000 USDC and 50.8 BTCB from BNB Chain, 11.91 million DAI, 64 million USDT, 10.1 million USDC, 13,146 ETH, and 52 BTC from Fantom. In addition, Avalanche saw an outflow of 2.38 million DAI and 33.76 WBTC.

The attacker channeled all the outflows to a central address. Interestingly, this address still holds $106 million worth of the asset at the reporting time. The absence of a sense of urgency has contributed to this attack’s intrigue.

The Multichain Attack

Recall that the Multichain attack started in the early hours of July 7 when millions worth of several assets were detected to have been withdrawn from the protocol. Wu confirmed that Multichain had witnessed $125 million in outflows and $122 million withdrawn from the Fantom bridge.

Notably, Multichain uses a multi-party computation (MPC) key to carry out transactions. The team behind Multichain noted that this key had been compromised, leading to abnormal withdrawals. 

Surprisingly, the attacker made no efforts to cover their tracks, leading to speculations that the attack could be an inside job or a rug pull. As of press time, this has not yet been confirmed. It bears mentioning that Zhaojun, the CEO of Multichain, has been AWOL since May, with no way for the team to contact him.

Multichain confirmed the attack in a tweet four hours after the outflows were detected, noting that it would suspend its bridge functionalities indefinitely. Stablecoin issuers Tether and Circle froze $65 million worth of the stablecoins withdrawn shortly after the first wave of outflows.

According to a report from blockchain analytical firm, Chainalysis, the exploit has the traits of a rug pull. The Chainalysis report cited the disappearance of Zhaojun and the nature of the attack. Loki Zeng, a former Huobi Ventures researcher, also noted that the attack does not look like a hack.