Ethereum abnormal fee transfer "new suspect": PlusToken attempts to use the mixer to hide its traces for money laundering?
Editor's Note: This article comes fromChain News ChainNews (ID: chainnewscom)Editor's Note: This article comes from
Chain News ChainNews (ID: chainnewscom)
Chain News ChainNews (ID: chainnewscom)
, Author: Frank Topbottom, Compiler: Lou Yue, published with authorization.
On June 10, an unknown address transferred 0.55 ETH (about $128), but the transaction fee was as high as 10,668.7 ETH (about $2.6 million), and the transaction was packaged by SparkPool.
About 20 hours after the first transaction occurred, the address transferred 350 ETH again, and also paid a huge transaction fee of 10,668.7 ETH (approximately US$2.6 million). This time the transaction was packaged by the Ethermine mining pool.
The magical operation of this mysterious address within two days set a record for the highest transaction fee in the history of the Ethereum chain. Is it a "good deed" or a "stolen"? These two transactions, which are enough to be recorded in the history of Ethereum, have aroused great attention in the market.
Since both of these unusual fee transactions came from the same address, the motives may also be the same.
Several public features about this mysterious address:
The address is a new one, with the first transaction dated June 7th (a few days before the first unusual transaction occurred);
This address has traces of "automated operation", because the transaction is very frequent, and the Gas fee is 60 Gwei;
Many transactions are related to Korean exchanges, mainly on Upbit;
In the first transaction, ETH is sent to the Bithumb deposit wallet, and in the second transaction to the Upbit deposit wallet;
The value of most transactions sent from this address is not an integer, so it is unlikely to be the address used by the transaction;
different mining pools (SparkPool and Ethermine);
Before the second abnormal transaction, the transaction did not stop.
Since a large amount of funds flowed from Bithumb's hot wallet to the mysterious address, linked to Bithumb's recent wallet migration activities, and most transactions were sent to Bithumb's own address for deposit, this mysterious address may be related to Bithumb's custody. However, it is relatively common for customers to transfer funds through wallets and exchanges.
According to Dune Analytics data, Upbit seems to be more closely related to the mysterious address. Generally speaking, the receiver and sender are often the same exchange address, but the data shows that some ETH goes directly to the exchange's user deposit wallet, which does not seem very plausible.
The image above shows how the funds in the recipient of the second transaction (one of Upbit's deposit addresses) are transferred to the Upbit hot wallet. The sender sends funds to the Upbit hot wallet through the one-time address. The one-time-use addresses in the graph are randomly selected and there are a large number of them. This indicates that it may be related to a cryptocurrency mixing service (hereinafter referred to as a mixer, mixer), and is associated with a Korean individual or entity exchange.
Mysterious address involved in Ponzi scheme PlusToken?
A link to the Ponzi scheme PlusToken was found in a trace of transaction mixers. Elementus discovered that the project had amassed nearly 10 million ETH, and found it on exchanges, mostly in Asia, shortly thereafter.
To prevent money laundering, most exchanges have adopted anti-money laundering (AML) policies. The PlusToken situation is much more complicated, though, as participants have been facing withdrawal issues since June 2019, when the Ponzi scheme had been in existence for over a year. Funds could have been transferred to several exchanges and moved in different wallets at the time, but it didn't get enough attention.
Currently, there are about 790,000 ETH in PlusToken's known addresses. The rest of the ETH was allocated to different wallets, which were not limited to exchange wallet addresses, so the transferred addresses were difficult to investigate.
The diagram above shows the flow of funds from PlusToken to the mysterious address. PlusToken used some low-active addresses to Upbit exchange, and ETH from Upbit hot wallet used a one-time wallet and finally appeared in a mysterious address.
The PlusToken address also leads to the exchange’s deposit wallets, which received funds from the mysterious address. In the example above, ETH from PlusToken received funds from a different stolen wallet via an address that may have been mislabeled as an exchange (in fact, it may have been a mixer address) in order to further clean up the trail. To confuse tracking of this address, an unknown WOR token was also issued, which has since been distributed from the mixer address. After the distribution is over, the token is no longer used.
Just a money laundering bot?
In summary, the address that sent two transactions and charged a fee of $5 million may be a bot that is laundering money and may be related to PlusToken, while most of the bot transactions are withdrawals to several exchanges in South Korea and deposit.
Another argument in favor of an illicit source of funds is the missing link between the owner of the address and the collection of fees. Ethermine pools SparkPool and Ethermine have already started distributing fees to their miners, so the extortion hypothesis deserves some scrutiny.
Nonetheless, the unusual transactions could be interpreted as an attempt to quickly launder money using pool refunds. If it is indeed a PlusToken, it may be possible to cut off the connection with the PlusToken address (to prevent address tracking) in this way.
