# Fantom Foundation Reuse Address

Date:: February 28, 2025

Time:: 18:00-4:00, break, 10:00

Amount Stolen:: $3,200,000

Tags:: 🔑

---

On Feb 28 2025, an alert went off for Fantom Hack address 0x1d93c73d575b81a59ff55958afc38a2344e4f878

The origin of these funds are from TRON. ~$3.2m was transferred Feb 28 2025 @ 6:22pm and bridged to Ethereum via Wan Bridge and Stargate.

- TDNaLds1A1g6vYRUvzpRdsNzftS4FPduQ5
- TYQ3455gFNeqyw3sqdcWuiARq4UTMqk4D4
- 0x9543434ae26bb41cd132b1f62e774bdb229f41b9

### These funds were then sent via 1inch limit orders to a new address:

- 0xcced1276382f4dd0a6d0e73b07f43294733981ae

### Funds were also sent and received via ChangeNOW::

- 0x51031016256e92707e92a674102c63ca87f848f363d801d1198d86f5a5d349be
- 0xdb5f1f3279d721502e07f97ff7ee0391a761b28f7320bc8c736a5fd9271ec280
- 0x240f4646c14aa72bcd42a199dba988e320a9c70d

### After 1inch the funds were dispersed into a number of addresses and ETH was depositted into the smaller Tornado Cash pools:

- 0x9f26481f6e72df32b313e5dd616d2090b8e9a144
- 0x264f19a485ada016e075ff7c0483cf41c27c3f23
- 0x1d93c73d575b81a59ff55958afc38a2344e4f878 - Fantom Hack Oct 23 
- 0x71dc9d54ae94033cb8135fdb3ce012bb51d5fdb7
- 0x3a76474d500bf7e65c6d3054932012f69233892f
- 0x54a207218c474ece34bd1c921adb1d41ac74054a
- 0x68a347d49b5320f87073e8a78d5f81ad9e5c0025
- 0xf9f5ac1944c7db7949a45179a0feab1d6a574329
- 0x99771e0193ecb73b2489bd646b6446704f5ca622
- 0x7a814ca074c3a36f27b9c20c9f54669b21125a89
- 0x350779ab7104d528eb2c3fe8e35fb007aef53a4f
- 0x3b22efc0aa0430e7e63ac61076c43ed9d58dbe52
- 0x17c21d8503b2166ac6050adad3b20300817c8c05
- 0xc08c4bfd32968dc68ba73639a2589c854269aaa2
- 0x648d0f91209cfa6e61369cd5354a415f47f7420a

- 0xb83fc487de69f80993561443aae5b8185603de10
- 0xdedb761b60f9e6bca71106d789e36f4dae4f6c01
- 0xc890dd50ad6810c7b33807ad8e8693c07140fa7a
- 0xd91b004d60f92bc335198ced84b5b18c24b35ff1
- 0xa1b87027fb6daff30cd48ff31f73c28344c87b44
- 0xce00e96febb33175fb0311253c51bc961078ab0a
- 0x525dacf5eaf8a61f9d41f88515954662168d3c70
- 0x1fafacb2fe238d0fa5cd10811217167ce1fe8fa1
- 0x22efb42f05837751fe8be7427fb08c39edf53f70
- 0x8227113a80ad42328477874d6ef3a1a02fe4f541
- 0x16fa8ef2e2c192806b5b1c332f93c4c39456a982
- 0x90d5a345c2cfcda1efb6066ae0527b8559209295
- 0x1fe695ecae9100ff2cba4537b01413feb61393b5
- 0x935e7e9b05bab1ec4c81bf6a70990a980aff0253
- 0x57ddefddeb279ee4ffdb2ed463b1e83242143a7b
- 0xfff0433bf18f988a576cd4ee07d8a505f359161a
- 0xa01562f3e757c27214ed80fffb9be5a85c6d9bf8
- 0x92bc67cb5f2049e9d4a277ed571ec8b62371c32b
- 0xff6e2d36c0c4a4de167aaf86d7fe7c488951dc6d
- 0xcb60a116c71f7ceb04f4447cf7625931e7077743
- 0x5da3280f4c91fb110dcf016ab0d07f97f33a9eb5
- 0xebc612ef074225bdc20705d45775a0698250fee6

### Leftovers were collected and then also sent to TC:

- 0xbf66d9b9a6dadd87c52ce5a6eb101bcfbdad19f8
- 0xec403b009d5d5a3bb74dd5619ce0aebb2bb56f66

### In total, the following deposits were made into TC:

- 5 x 0.1 = 0.5
- 78 x 1 = 78  
- 96 x 10 = 960
- 4 x 100 = 400
- Total = 1438.5 ETH = ~$3,221,150

I don't know.


## Withdrawals:

- 0x5129DB7E53Fe5Cdd753fB582dB77Aaaece5F33D3    22x10 
- 0xa0C95f8798E343e4439477718525922d0E87d322    15x10         1x100
- 0xEDBFF5D7efbe13DBC9F7af6039dBdf136F4F824A    20x10   11x1
- 0x0AAd129B7a11d27c9ce26893e3f36B673ccc6aa0    11x10         1x100
- 0xfDDfd68E9454CA67E10F1389D6CB924d94674969    19x10 
- 0x38dA4BCDe771eFC3d8506ddf3f65089baAd94e65     6x10    1x1  1x100
- 0xb6d0689A2F95F53747e65EF30305D890D3029607     3x10   10x1  1x100
- 0xbef00ce63b2f3603c14736ddad6c1a6b158fa8e3            20x1 

- TOTAL                                         96x10   42x1  4x100


- 0x7a7dda0ebff13eb014f763d05e7784b36418022f - Post-Tornado Consolidation 

- buys pepe lol wat

- fast forward 2026

- 0x7cc8ef645c698af7c9a49d76d13a2ff441005d6d

- 0xcf772d4fcf80c2b0e63308cf30ec0358ca73ba04 2025-12-14

- 0xdf2c7fb5a7c62389f4b082c9916b3fc18fff7e9a 2025-12-15

- 0x558db42c9384db6415e2015e3c40794cfbb7a28e 2025-01-05






## Tornado Cash / PEPE Situation


Upon further investigation, it appears that DPRK may have been rugged by a fake Tornado Cash UI. 💀

The UI in question is likely related to this UI which various parties had been blocking and trying to get unblocked for a while:

- `tornadoeth.cash`

- https://github.com/MetaMask/eth-phishing-detect/pull/14820


### Jan 16 2025  (Confirmed to have used the above UI, PEPE Buyer)

- 0xe6075ffdb3350771b6364941a725fec086643438 - Jan16 Input
- 0x5d3a17a828aeb89729299ba5dd72200295b00df0 - Jan16 Output (Confirmed)


### Feb 10 2025 (Suspected, PEPE Buyer)

- 0xb20972d12a8bc96f63fda0243e73a961f9e4afc2 - Feb10 Input
- 0x921213AB8cB18E0487B41DfFf18E39836FD19f04 - Feb10 Output


### Mar 01 2025 - DPRK Inputs (Suspected, PEPE Buyer)

- 0x30288a7d4cfbcb4984f26f8adb66164115e027a2 - Mar01 Input + Original Fantom Foundation Theft Address
- 0x1fe695ecae9100ff2cba4537b01413feb61393b5 - Mar01 Input
- 0x90d5a345c2cfcda1efb6066ae0527b8559209295 - Mar01 Input
- 0x935e7e9b05bab1ec4c81bf6a70990a980aff0253 - Mar01 Input
- 0xebc612ef074225bdc20705d45775a0698250fee6 - Mar01 Input
- 0xd91b004d60f92bc335198ced84b5b18c24b35ff1 - Mar01 Input
- 0xc890dd50ad6810c7b33807ad8e8693c07140fa7a - Mar01 Input
- 0x5da3280f4c91fb110dcf016ab0d07f97f33a9eb5 - Mar01 Input
- 0xce00e96febb33175fb0311253c51bc961078ab0a - Mar01 Input
- 0xc08c4bfd32968dc68ba73639a2589c854269aaa2 - Mar01 Input
- 0xa01562f3e757c27214ed80fffb9be5a85c6d9bf8 - Mar01 Input
- 0x525dacf5eaf8a61f9d41f88515954662168d3c70 - Mar01 Input
- 0x92bc67cb5f2049e9d4a277ed571ec8b62371c32b - Mar01 Input
- 0xa1b87027fb6daff30cd48ff31f73c28344c87b44 - Mar01 Input
- 0xfff0433bf18f988a576cd4ee07d8a505f359161a - Mar01 Input
- 0x22efb42f05837751fe8be7427fb08c39edf53f70 - Mar01 Input
- 0x1fafacb2fe238d0fa5cd10811217167ce1fe8fa1 - Mar01 Input
- 0x57ddefddeb279ee4ffdb2ed463b1e83242143a7b - Mar01 Input
- 0x8227113a80ad42328477874d6ef3a1a02fe4f541 - Mar01 Input
- 0xdedb761b60f9e6bca71106d789e36f4dae4f6c01 - Mar01 Input
- 0x16fa8ef2e2c192806b5b1c332f93c4c39456a982 - Mar01 Input
- 0xb83fc487de69f80993561443aae5b8185603de10 - Mar01 Input
- 0xcb60a116c71f7ceb04f4447cf7625931e7077743 - Mar01 Input
- 0x3a76474d500bf7e65c6d3054932012f69233892f - Mar01 Input
- 0xff6e2d36c0c4a4de167aaf86d7fe7c488951dc6d - Mar01 Input
- 0x71dc9d54ae94033cb8135fdb3ce012bb51d5fdb7 - Mar01 Input

- 0xb6d0689a2f95f53747e65ef30305d890d3029607 - Mar01 Output
- 0x38da4bcde771efc3d8506ddf3f65089baad94e65 - Mar01 Output
- 0xfddfd68e9454ca67e10f1389d6cb924d94674969 - Mar01 Output
- 0x0aad129b7a11d27c9ce26893e3f36b673ccc6aa0 - Mar01 Output
- 0x5129db7e53fe5cdd753fb582db77aaaece5f33d3 - Mar01 Output
- 0xa0c95f8798e343e4439477718525922d0e87d322 - Mar01 Output
- 0xedbff5d7efbe13dbc9f7af6039dbdf136f4f824a - Mar01 Output

- 0x7a7dda0ebff13eb014f763d05e7784b36418022f - Mar01 Consolidation + PEPE Buyer



### March 05 2025 - Unknown, PEPE Buyer

- Input unknown

- 0x77793F723A5538972A566D701cc7FBd32770CC96 - Mar05 Output (PEPE Buyer)



## TODO

#### Params for the malicious frontend are: 

- X.XXXX / 1 / 3 / 89.76
- X.XXXX / 1 / 3 / 88.77
- X.XXXX / 1 / 3 / 88.78
- X.XXXX / 1 / 3 / 89.26
- X.XXXX / 1 / 3 / 89.27

#### Other **potential** thefts via a fake TC UI include the below. Also possible these are just lazy motherfuckers who use the TC UI and withdraw literally instantly. 🤷‍♀️

- 0x9107302048dab46874931cfd0106ae4b7f3af099  - Input Jan08
- 0xe13cb2ecae698cfc49e9aaf2c9c335335d134fc8  - Output Jan08

- 0xc67255899a416a02ac0afc33d0aeb971abf18dfc  - Input Jan14
- 0x79da438177fce1de4bfc188d82b7e6ae7c06c6d3  - Output Jan14

- 0x723b46df3dca205725f51d8c11aa69cc1c55be18  - Input Feb05
- 0x81bc970f9fd6a5fcd48a6ceea70d9109c26ce618  - Input Feb05
- 0x7076e23b1bac1b6d06d7667c33fc43f23ba5e228  - Input Feb05
- 0x7bf8c9411ab35a410e35b05f6b814eea045e34a4  - Input Feb05
- 0xb4d35df985aaf6a4ce526cbadbf284658b395b94  - Input Feb05
- 0x2c29694063d9c428a8b8209f8d7572562782f098  - Input Feb05
- 0x398039d0d0f44164202454357c21035592aae6fc  - Input Feb05
- 0x94d2cc03c56b61656f32faa6df2279839de9a337  - Input Feb05
- 0x4975fc52db9b56b7e4c0a8ebdd6c4b3694cd8570  - Input Feb05
- 0x0b4773dd31f49e3b8f129d6454b4c64a468dde2f  - Input Feb05
- 0x8111595e595a7a5b278e56aa527468164c048161  - Input Feb05
- 0x17b7f5e12c2a8705da4f62bc12a7ba64d187bd87  - Input Feb05
- 0xa4d023c3c3e8d5ee6e8d4da7648508cca34a0b8e  - Input Feb05
- 0x206360123273327b03cc966e653252cdb7c699f7  - Input Feb05
- 0xeaf02962ec39fc4ec23e8f2677c9bc7e927ca468  - Input Feb05
- 0x91bb10b79297356f672982f05005df12bfb265c1  - Input Feb05
- 0x1d147d2220fe04c41ada5c12f9cb89bf623673d5  - Input Feb05
- 0xde395bb5e2f69ec7f1cf754e7f03b1a90b9a0c7a  - Input Feb05
- 0xe467eb4c201895128c57fc18d43164ee74ebf567  - Input Feb05
- 0x23288000cf7eef43ebdfc3fad15b6e89b9ed49a7  - Input Feb05
- 0xf0da7efed58467b5ae9af5841bd634bf8f998d70  - Output Feb05

- 0x313708e21398421d3b260494c0bf233403aefc99  - Input Feb18
- 0xdc0ddca33bde1af82302bf285eba0d02a9e13f0a  - Output Feb18

- 0x9c3dad9fd89ab590ae8f5dca09de6f67f8dec058  - Input Feb20
- 0xfce0ecbfaddb7c534e86394842af7d8d0778ebaa  - Output Feb20

- 0xfa51a135a2ca00a6b3bc28448bd4e2aaa4fe34d1  - Input Feb22
- 0x96f947417a35469c48870f40f26d9148c0ed7014  - Output Feb22

- 0xbd79a45777d2f25efdac254b43f4f4e0c891a0c1  - Input Mar04
- 0x890d28d0aad21299159efecd5fcf217a7da142a1  - Input Mar04
- 0x47bcf4677bce1be8ad9bb83c26a121c4a7088d46  - Input Mar04
- 0xb9e0af9b0f71b894f2549d17492a9c257f32b13d  - Input Mar04
- 0x54e807c32be4aebc2419adadebbf9fe9ddf5cae2  - Input Mar04
- 0xa2c005844d65c2ccb8355901b1cccb9cc04c1fb2  - Input Mar04
- 0x2ceaa5c47d5e3a5ddf828219be7f7d002339fbe9  - Output Mar04
- 0x36cae387c782db13a2cc74f6f3308bee6870f4b7  - Output Mar04
- 0x3f7e5c54c5ddc12b7495bdc8a2c70d269c620b19  - Output Mar04
- 0x5e7acaf85017be09b0f5074277a9493701cd4796  - Output Mar04
- 0xb770f522f1c6a998b7505d3491e6e6f0cc7826f5  - Output Mar04

- 0x2dd810bc6506e24a6a8c55ebeacc24cd907baf97  - Input Mar06
- 0x7eb8dc0e75b3132fe9f6f49512e021b720819ccc  - Input Mar06
- 0x445d73694c58f4ebaafee232f2ba41d2bf1e334c  - Input Mar06
- 0x1f88a968bd1bb6a6734c87c62ce6fec78a7b7309  - Input Mar06
- 0x1f1785146418925a08c238e0e33c463b7b504cd9  - Input Mar06
- 0x1c1046139e6f8b69726ac7d7d139e4bc0a99c05f  - Output Mar06
- 0x679f5916608cdd48325668a925f439194698dd53  - Output Mar06