Blockchain sleuth uncovers identity of PrismaFi’s hacker, who stole $11m

The exploiter proceeded to make audacious demands, including a $3.8 million (34%) whitehat bounty, significantly higher than the industry standard of 10%, ZachXBT noted, adding that the demand was “essentially extorting the team as the treasury does not have sufficient assets to reimburse users.”

Further investigation revealed that the exploiter’s address received funds via FixedFloat and was subsequently located on Arbitrum, a layer-2 solution on Ethereum. By analyzing timing, ZachXBT found that the exploiter’s address was connected to withdrawals on TRON, including those from the Bybit crypto exchange.

The investigation also uncovered connections to previous exploits, such as the Arcade_xyz exploit from March 2023 and the Pine Protocol exploit from February this year. The exploiter, using the alias 0x77 on Telegram, remained active, with ties to the deployer of @modulusprotocol, further solidifying the link between each incident.

The investigator also disclosed conducting an analysis of the exploiter’s personal information, gathering phone numbers and emails, which suggested a proficient technical background. Currently, all gathered personal data has been forwarded to the Prisma team, who are pursuing legal action against the hacker in Vietnam and Australia, ZachXBT added.