The largest theft in Crypto Assets history: a certain platform suffered a loss of $1.5 billion due to a Hacker attack.

On February 21, 2025, a well-known crypto assets trading platform suffered a major security incident, resulting in the theft of approximately $1.5 billion in assets from its Ethereum cold wallet. This incident is considered the largest single theft in the history of crypto assets, surpassing other large-scale thefts that occurred in 2021 and 2022, causing a tremendous shock to the entire industry.

This article will provide a detailed account of the hacker incident and its money laundering techniques, and remind readers that in the coming months, there may be a large-scale freeze targeting the over-the-counter trading community and crypto assets payment companies.

Detailed Explanation of the Theft Process

According to the description from executives of the trading platform and preliminary investigations by a blockchain analysis company, the theft process is roughly as follows:

1. Attack Preparation: The hacker deployed a malicious smart contract at least three days prior to the incident, laying the groundwork for the subsequent attack.

2. Invasion of the multi-signature system: The trading platform's Ethereum cold wallet uses a multi-signature mechanism. A hacker infiltrated the computer managing the multi-signature wallet through unknown means, possibly using a disguised interface or malicious software.

3. Cloaking Transactions: On February 21, the trading platform planned to transfer ETH from the cold wallet to the hot wallet. The Hacker took advantage of this opportunity, disguising the trading interface as a normal operation, and诱导 the signers to confirm an instruction that appeared to be legitimate but actually altered the logic of the cold wallet smart contract.

4. Fund Transfer: After the instruction took effect, the Hacker quickly took control of the cold wallet, transferring approximately $1.5 billion worth of ETH and ETH staking certificates to an unknown address. Subsequently, these funds were dispersed to multiple wallets and began the money laundering operation.

Hacker's Money Laundering Techniques

Money laundering is mainly divided into two stages:

Phase One: Fund Splitting

• The attacker quickly exchanged the ETH staking certificate for ETH coins.
• Rigorously split and transfer ETH to subordinate addresses in preparation for laundering.
• During this process, the attacker's attempt to exchange 15000 mETH for ETH was halted, recovering some of the losses.

Phase Two: Fund Cleaning

• Utilize centralized and decentralized industry infrastructure for fund transfer and exchange
• Exchange part of the stolen funds for BTC, DOGE, SOL, and other Crypto Assets.
• Issue meme coins or transfer funds to the exchange address for obfuscation

Currently, blockchain analysis companies are monitoring and tracking addresses related to stolen funds to prevent users from mistakenly receiving stolen funds.

Hacker Gang Background Analysis

By analyzing the flow of funds, it was found that this attack is related to two exchange theft incidents that occurred in October 2024 and January 2025, indicating that these three attacks may have been orchestrated by the same entity.

Combining its highly industrialized money laundering techniques and attack methods, some blockchain security experts speculate that this incident may be related to a notorious Hacker organization. This organization has launched cyberattacks on institutions and infrastructure in the crypto assets industry multiple times over the past few years, illegally obtaining cryptocurrencies worth billions of dollars.

Potential Freezing Crisis

Security experts have found in investigations over the past few years that this hacker organization not only uses decentralized platforms for money laundering but also heavily utilizes centralized exchanges for dumping. This directly leads to many exchange users' accounts, which inadvertently received stolen funds, being subjected to risk control, and the business addresses of over-the-counter traders and payment institutions being frozen.

The following are two related cases:

1. In 2024, a Japanese cryptocurrency exchange was attacked, and Bitcoin worth $600 million was stolen. Some of the funds were transferred to a cryptocurrency payment institution in Southeast Asia, resulting in the freezing of the institution's hot wallet address, and approximately $29 million became untransferable.

2. In 2023, another trading platform was attacked by a suspected hacker organization, resulting in losses exceeding $100 million. Some of the stolen funds were washed through over-the-counter trading, leading to the freezing of business addresses for many OTC traders, or their exchange accounts being risk-controlled, severely affecting normal operations.

Conclusion

Frequent hacking incidents have not only caused significant losses to the Crypto Assets industry, but subsequent money laundering activities have also tainted the addresses of many innocent individuals and institutions. For these potential victims, it is essential to be particularly vigilant during business activities and closely monitor suspicious fund flows to avoid having their own interests affected.