Binance hack: overnight the attacker moved about $2.4M on Tron through a token created for the job.
The token, LXXY, was deployed on Oct 31 at 16:19 UTC with a SunSwap pool against jUSDT, the USDT deposit token of JustLend. Its creator can mint it and decides who may trade it.
Six wallets funded from the attacker's Tron root bought LXXY with jUSDT, three of them whitelisted by the creator minutes before. That put about $2.4M into the pool. Then the creator minted LXXY to two fresh wallets, which sold it into the pool and took out about $2.73M.
That money went back to TRX, was split into lots, and swapped into USDT paid straight into the Tron deposit of the Bitget Wallet cross-chain swap (its router contract is named BWSwapRouterV1), which pays out ETH on Ethereum. Overnight more than $5M of the attacker's money left Tron through that swap. We have sent the wallet list to Bitget.
The token, LXXY, was deployed on Oct 31 at 16:19 UTC with a SunSwap pool against jUSDT, the USDT deposit token of JustLend. Its creator can mint it and decides who may trade it.
Six wallets funded from the attacker's Tron root bought LXXY with jUSDT, three of them whitelisted by the creator minutes before. That put about $2.4M into the pool. Then the creator minted LXXY to two fresh wallets, which sold it into the pool and took out about $2.73M.
That money went back to TRX, was split into lots, and swapped into USDT paid straight into the Tron deposit of the Bitget Wallet cross-chain swap (its router contract is named BWSwapRouterV1), which pays out ETH on Ethereum. Overnight more than $5M of the attacker's money left Tron through that swap. We have sent the wallet list to Bitget.
