Per a recent disclosure from Peck Shield, a blockchain security firm, the hacker executed a precise transfer of 1,537 ETH to a Seneca address. On-chain data substantiates this claim, indicating that the transaction occurred through three separate transactions.
#PeckShieldAlert @SenecaUSD hacker-labeled address has returned 1,537 $ETH (worth ~$5.3m) to #Seneca: Deployer address & transferred 300 $ETH (~$1.04m) to 2 new addresses pic.twitter.com/hNOFMr1aTk
— PeckShieldAlert (@PeckShieldAlert) February 29, 2024
Significantly, the function lacked proper input validation, allowing anyone to initiate external calls. The hacker first diverted 907 ETH valued at $3 million before stealing 1,000 ETH tokens, distributing them equally to two newly created external wallets.
Curiously, a few hours after transferring the 1,000 ETH to the new wallets, the exploiter returned all tokens to the new Seneca address. This restitution took the form of two separate transactions, each amounting to 500 ETH, executed at 5:09 (UTC) on Feb. 29 from the external wallets.
Following the transfer of the 1,537 ETH to the Seneca address, the primary address involved in the exploit then proceeded to shift 300 ETH, equivalent to $1.03 million, through two transactions to two distinct new external wallets, a transaction that could represent the hacker’s bounty.
