Sign in Subscribe

BlockThreat - Week 9, 2025

ThorChain | Chainflip | Teva | Invisitech | Toshi

Peter Kacherginsky

• 6 min read
BlockThreat - Week 9, 2025

Greetings!

Last week, we discussed how a North Korean threat actor compromised Safe’s infrastructure and Bybit’s cold storage wallet. However, the story didn’t end there—the attacker immediately launched a wild money laundering operation, swapping and bridging most of the stolen funds to Bitcoin in just 10 days.

What was fascinating was watching how different exchanges and DeFi protocols reacted as the stolen funds moved through their platforms:

The Good:

  • Mantle’s mETH protocol was amoung the first to act, freezing $43M worth of stolen mETH tokens.
  • OKX provided next hop addresses for its swapping service.
  • Chainflip reacted to swapping attempts by going into maintenance mode and instituting an upgrade to prevent the use of its bridges.
  • Tether froze $604K on Tron and Ethereum networks in a couple of hours.

The Bad:

  • ThorChain, a DPRK favorite, faced the most heat as the primary tactic to bridge about $1B to bitcoin chain while earning record $5.5M in fees. Unable to implement governance or technical controls to stop transactions, a core ThorChain developer decided to leave the project.
  • Circle was, as always, slow to freeze funds, even when presented with solid evidence.

The Ugly:

  • eXch was responsible for about $95M of funds but outright refused to assist.

The responses above provide a good indication of what to expect in the event of a hack. If a sufficiently large sum of stolen funds moves through a protocol with freezing or pausing functionality, there’s a strong chance it will take action (e.g. mETH, Tether). Circle remains an exception—it typically requires a significant amount of stolen funds and public outrage before freezing assets without a court order.

Bridges pose a unique challenge since their primary function is to transfer funds between chains without obfuscating the final destination. As ThorChain argued, it’s not their responsibility to stop illicit transactions—just as it’s not up to nodes or RPCs to impose filtering. While this aligns with cypherpunk ideals, courts and law enforcement may not share that perspective. I am worried of a TC-like crackdown on bridge founders which would hurt the industry.

And then, there are platforms like eXch, which provide no controls and actively resist assistance requests. However, as history has shown with ChipMixer, Liberty Reserve, BTC-e, and, more recently, Garantex, these platforms eventually get shut down—only for new ones to emerge and fill the lucrative void.

To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.

Let’s dive into the news!

News

Crime

Policy

Phishing

Malware

Contests

Media

Research

Tools

Hacks

Toshi

Date: February 24, 2025
Attack Vector: Reentrancy
Impact: $11,000
Chain: Base

References:

https://x.com/TenArmorAlert/status/1894034493675110805

Exploit:

https://basescan.org/tx/0xad3dfc7da49979661404e0e91753d7928dc44bc948a96495b6ea8a7ef9ec7331

https://basescan.org/tx/0x331084925aa1b45ee9087dc4092a4b2fc6bb6c1b155dbe0b405a75541d19ed1a

Invisitech

Date: February 24, 2025
Attack Vector: Insufficient Function Access Control
Impact: $15,000
Chain: BSC

References:

https://x.com/TikkalaResearch/status/1894099890663289294

Exploit:

https://bscscan.com/tx/0x92126f0bde98d360b37b7074fea6f41fd47fd19d1cced134681ff64b1aef56b8

Teva

Date: February 25, 2025
Attack Vector: Forgotten approval
Impact: Assets Stolen
Chain: Base

References:

https://x.com/TenArmorAlert/status/1894571261843411356

Exploit:

https://basescan.org/tx/0x176f65954008289c996b25324406e518917c739acd2a43ecf3fc89b19504ea7c

Sign up for more like this.

Enter your email
Subscribe