On June 3rd, the cryptocurrency wallet Atomic Wallet was targeted in an attack, resulting in a significant amount of user assets being stolen. Some users suffered losses exceeding millions of dollars, causing widespread impact. SharkTeam conducted an analysis of the attack principles employed in this incident, as well as the hackers' money laundering patterns.

1. Analysis of the Attack Principles:

SharkTeam conducted a closed black-box testing on Atomic Wallet, focusing on the app and server API. The testing process is outlined as follows:

(1) The tested versions were Android's Atomic Wallet 1.13.20 and 1.15.1. We matched the packaging and publishing certificate information of the Android application and found them to be consistent with the official certificates. This ruled out the possibility of "repackaging + phishing websites" attacks aimed at stealing private keys.

(2) We analyzed the local cache files of the app and determined that sensitive data related to account information was obfuscated and encrypted.

(3) We conducted packet capturing during the app's runtime, but no attack behavior involving key upload or leakage was detected. Additionally, the data had undergone reasonable encryption measures.

(4) The Android client lacked dynamic protection and reinforcement measures, making it susceptible to injection attacks. Users could be targeted and their private keys compromised if they installed malicious apps controlled by hackers. These malicious apps could be installed through social engineering techniques or as pre-installed applications in certain malicious Android systems.

(5) By using a traffic monitoring tool to examine network connections and observing the HTTP, DNS, ICMP, SSH, and other traffic patterns after a period of operation, no obvious instances were found of the app sending sensitive data to third parties. Analysis of the interactions between the app and the backend API revealed that all API interfaces required authentication, and no unauthorized or hidden interfaces were discovered.

Based on the testing and analysis, we identified the following as the most likely attack vectors for this incident:

(1) It is possible that a malicious SDK was inadvertently introduced during the development process of Atomic Wallet, creating a backdoor through a "software supply chain attack" by which hackers gained unauthorized access.

(2) Leakage of information related to the data encryption algorithm, leading to the discovery of encryption methods and vulnerabilities, and subsequent brute-forcing of private keys.

(3) The lack of dynamic protection in the Android app client allowed for the implantation of malicious software into users' Android devices, enabling injection attacks to steal user passwords or private keys.

2. Analysis of Money Laundering Patterns:

As a result of the hacker attack on Atomic Wallet, users suffered losses of at least $35 million, with the top five victims accounting for $17 million. One particular user had $7.95 million stolen. Furthermore, according to ChainAegis, SharkTeam's on-chain security analysis platform, the total losses incurred by victims have exceeded $50 million. We conducted a fund flow analysis on the addresses of two victims from the top five in terms of losses. After eliminating the technical interference factors set up by the hackers (including a large number of false token transfers and transactions divided among multiple addresses), we identified the following money transfer patterns employed by the hackers:

Victim 1 address 0xb02d...c6072 transferred 304.36 ETH to the hacker's address 0x3916...6340. The funds were then divided eight times through the intermediate address 0x0159...7b70 before being aggregated to address 0x69ca...5324. Subsequently, the aggregated funds were transferred to address 0x514c...58f67, where they currently remain. The address holds a balance of 692.74 ETH (worth $1.27 million) in ETH.

Victim 2 address 0x0b45...d662 transferred 1.266 million USDT to the hacker's address 0xf0f7...79b3. The hacker divided it into three transactions, with two transfers going to Uniswap, totaling 1.266 million USDT. The remaining amount was transferred to address 0x49ce...80fb, with a transfer amount of 672.71 ETH. Victim 2 also transferred 22,000 USDT to the hacker's address 0x0d5a...08c2. The hacker utilized intermediate addresses like 0xec13...02d6 for multiple rounds of fund division, eventually consolidating the funds to address 0x3c2e...94a8.

This money laundering pattern closely aligns with the techniques observed in previous attacks by North Korean hackers in the Ronin Network and Harmony incidents. The pattern involves three steps:

(1) Consolidation and conversion of stolen funds: After the attack, the stolen tokens are consolidated and swapped for ETH using decentralized exchanges (DEX) or similar methods. This is a common practice to avoid freezing of funds.

(2) Aggregation of stolen funds: The consolidated ETH is collected in several one-time-use wallet addresses. In the Ronin incident, the hackers used nine such addresses, while in the Harmony incident, they used 14. In the case of the Atomic Wallet incident, nearly 30 addresses were used.

(3) Transfer of stolen funds: The collected funds are laundered using Tornado.Cash, effectively completing the entire money transfer process.

In addition to following the same money laundering pattern, there are significant similarities in the laundering details:

(1) The attackers demonstrate patience, conducting the laundering operations for up to a week. They initiate the subsequent laundering actions a few days after the initial attack. Currently, a portion of the stolen funds in the Atomic Wallet incident has been divided, but the process of mixing them through Tornado.Cash has not yet begun. It is likely that the mixing will commence in a few days.

(2) Automated transactions are utilized throughout the money laundering process. Most of the fund aggregation actions involve multiple transactions with small time intervals, following a consistent pattern.

Based on the on-chain analysis, we conclude the following:

(1) The money laundering techniques employed in the Atomic Wallet incident exhibit consistency with the laundering methods observed in the Ronin Network and Harmony incidents. These methods involve dividing funds among multiple accounts and conducting small-scale asset trans fers. Therefore, it is possible that The attackers are affiliated with North Korean hacker organizations.

(2) However, in the function transfer proces of the atomic incident, a significant number of false token transactions we identify. Technique to increase the diffical of analysis. fund division, with 23 of them being associated with false token transfers. This interference technique was not observed in the previous two incidents, indicating an upgrade in the hackers' money laundering tactics.

(3) Currently, the stolen funds from the Atomic Wallet incident remain in the divided addresses. If this is indeed an attack by North Korean hackers, the laundering process is not yet complete, and it is possible that the funds will be transferred to Tornado.Cash for mixing, similar to the Harmony incident.

(4) During the analysis of fund flows, addresses 0x3c2eebc and 0x3b4e6e7e were observed to interact with hot wallet addresses labeled as "Binance 18" and "Binance 14," respectively. However, due to the small transfer amounts, it is not ruled out that these interactions may not have undergone Know Your Customer (KYC) verification on the Binance platform.

About us

SharkTeam’s vision is to comprehensively protect the security of the Web3 world. The team is composed of experienced security professionals and senior researchers from all over the world. They are proficient in the underlying theory of blockchain and smart contracts, and provide services including smart contract auditing, on-chain analysis, and emergency response. It has established long-term cooperative relationships with key players in various fields of the blockchain ecosystem, such as Polkadot, Moonbeam, polygon, OKC, Huobi Global, imToken, ChainIDE, etc.
Official website: https://www.sharkteam.org/
Twitter: https://twitter.com/sharkteamorg
Discord: https://discord.gg/jGH9xXCjDZ
Telegram: https://t.me/sharkteamorg