ZachXBT Profile picture
Oct 23 11 tweets 6 min read Read on X
1/ Meet Yicong Wang (王逸聪), a Chinese OTC trader who has helped Lazarus Group convert tens of millions of stolen crypto to cash from various hacks via bank transfers since 2022. Image
Image
Image
2/ A follower reached out to me a few months ago after having their exchange account frozen after completing a P2P transaction with Yicong Wang an OTC who has used pseudonyms like Seawang, Greatdtrader, & BestRhea977 Image
3/ They then shared one of Yicong Wang’s Tron wallet addresses with me from a screenshot of their WeChat conversation.

THsSCBGazjjho7u2BQQsmrpbDv1Q237FL4 Image
4/ Recently they reached back out after having been approached by Yicong Wang for a larger USDT -> CNY order on August 13, 2024 involving ~1.5M USDT at a rate much lower than the market rate.

THjaAygUNkzoXufwEoKCzbUZHpsehL9rAZ Image
5/ When reviewing blockchain data tied to Yicong Wang you will notice high illicit fund exposure from the Alex Labs, Irys co-founder, and a consolidation of other hacks (EasyFi, Bondly, Maverick co-founder, etc). Image
6/ $17M from 25+ Lazarus Group hacks consolidated to 0x5018cf5f48a09c46b4833890cc2cf0df2533d16a where 374K USDT was blacklisted by Tether in Nov 2023

After the blacklist the remaining funds were deposited to Tornado. Within days after the deposits 13 X 100 ETH was withdrawn and consolidated at 0x81a

In Dec 2023 $45K was bridged to Tron and transferred to multiple addresses tied to Yicong.

Read my investigation below for detailed tracing of the 25+ hacks.Image
Image
7/ Alex Labs was hacked for ~$4.5M in May 2024 by Lazarus Group.

One of the theft addresses deposited 470 ETH to a privacy protocol on June 16, 2024
0xc0a0ec4dbf170611cc76f31a9df910ad79bc2266

Matching amounts were withdrawn the same day to two addresses
0x9fc1350f80734044b7189fe7b8f288396f76feb5
0x21c926a1a328a4906feeb18664d00f3d85df1aed

Another theft address deposited 449 ETH from June 27-28th
0x1871bb6257b1f622548ef64a12ae5149eb208bd8
Shortly after a matching amount was withdrawn commingling with the Irys co-founder stolen funds.
0xddb2e9feaf0a122b43be14bc085cf713703ce45c

On August 13th funds were bridged from Ethereum to Tron address tied to Yicon.Image
8/ Irys co-founder was hacked for ~$1.3M in July 2024 by Lazarus Group via email spear phishing campaign.

From the theft address 70.8 ETH was deposited to a privacy protocol and another 338 ETH shortly after on July 31st.
0x600cd901d0407753c212ed17d8c6cae014ee300e

By performing a timing analysis matching amounts were found hours after the deposits to two addresses.
0xff87a4df67068464e5f4e3b546f556b2dffb6dfb
0xa81eac50c0b17aee3132f40f7398087e457ca054

Funds were then commingled with the Alex hack and bridged to Tron addresses tied to Yicong on August 13th.
TG3dqSzpH3V2kEqTdJAYQrtZq1TQxysUkHImage
Image
9/ An Ethereum address blacklisted by Tether in August 2024 with 948K is also directly tied to Yicong.

On Aug 13th 746K USDT was transferred to an address tied to Yicong
THjaAygUNkzoXufwEoKCzbUZHpsehL9rAZ

Shortly before the funds had been bridged over from Ethereum linking the blacklisted address
0x84d9ad5e6fdf7ca4de37684a1f7df371837e9a9cImage
Image
Image
10/ While Yicong Wang has been banned from Paxful and Noones on multiple accounts (Seawang/Greatdtrader/BestRhea977) for laundering funds he has since moved to conducting business offsite.

It’s apparent from on-chain he has still been actively helping Lazarus Group within the past couple weeks.

Hopefully at some point in the future Yicong Wang will be held accountable for his actions.Image
Image
Image
Image
Update: Yicong Wang made his X account private and deleted a lot of the posts where he had asked exchange support for help unbanning his exchange accounts. Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with ZachXBT

ZachXBT Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @zachxbt

Nov 20
1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support. Image
Image
Image
2/ A US based victim sent me a DM on Oct 7, 2024 after receiving a call from a spoofed number impersonating Coinbase support where they were coerced in to using a phishing site.

Theft address
bc1qra7s4wl8z2el335k40sdnaka04c2sdwjx5hs6q
0x730082b1847e1cef889ea6dce57641c96c104f2d

Phishing site: https(:)//19960018-coinbase(.)comImage
3/ An initial tracing of the theft saw all of the stolen funds flow to eXch on Ethereum and Bitcoin where funds were converted to Litecoin and transferred to numerous services. Image
Read 9 tweets
Nov 3
1/ Time to share how SCALE, NTD, TPU, & OPSEC projects were all tied to the same person Zopp0 to farm naive traders using numerous influencers shown in leaked messages. Image
Image
2/ While paying others to be the face of OPSEC behind the scenes he was involved with key decisions as the owner in private Telegram chats.

Here is him talking about the lack of technical research.

I then confronted him over DM about this in March 2024 which he downplayed.

Then in a leaked private chat here is him chatting about me obtaining this screenshot.Image
Image
Image
Image
3/ Zopp0 and his friend SZB discuss how they messed up bundling for NTD/TPU and worry it will trace back to them.

No posts have been made from @NTensorDynamics @tensorspace_ai since April. Image
Image
Image
Image
Read 7 tweets
Oct 20
1/ A short story about how the influencer @0xjaypeg got caught lying to the community three times this weekend about an allocation for a project all for $2.2K. Image
2/ A project reached out to Jaypeg who agreed to promote a meme coin for 2% of the supply.

8jpz1pDotD7NVBWuYQgfSNX2CAVTp6wyD5Jgg7d5515B

After sending his wallet address in the chat Jaypeg deleted his message and lied saying he never received tokens and claimed it was not his wallet.Image
Image
Image
3/ 8jpz1p sold the tokens for ~$2.2K

3XwAA6GpNH6jzpqm6ztbDSixnre3iuB6JXYigdZN1T8EdTUK8qqjoJNf9dp9DpNR2rQHsWzsDHFRvut47p2Zy7zk
5GiGcgtkHPkvHVXCvqqxVzBZD2cLE7nvQMHmkWFnqUtsvcKEJQUuLSmVxVU7G2f8pCWHtnJocSfHRQud5TkK1GZg

The team followed up with him multiple times on it but he shifted the blame to them and did not resolve the mistake.Image
Image
Image
Read 7 tweets
Sep 19
1/ An investigation into how Greavys (Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen. Image
Image
2/ Incident Summary: On August 19, 2024 the threat actors targeted a single Genesis creditor by:

1) Calling as Google Support via spoofed number to compromise personal accounts
2) Calling after as Gemini support claiming account is hacked
3) Social engineered victim into resetting 2FA and sending Gemini funds to compromised wallet
4) Got victim to use AnyDesk to share screen and leaked private keys from Bitcoin core.

Gemini txn hash
59.34 BTC - Aug 19 at 1:48 am UTC
e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360
14.88 BTC - Aug 19 at 2:30 am UTC
7c7ebed785f0b4d4335d559b14b8215862fbe29db329e3ee0f2a7e64a16ce9e3Image
Image
Image
3/ Here is a private video recording showing the live reaction by multiple of the threat actors to receiving $238M.

Theft txn hash
4064 BTC - Aug 19 at 4:05 am UTC
4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090
Read 15 tweets
Aug 15
1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed.

Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities.

I then uncovered 25+ crypto projects with related devs that have been active since June 2024.Image
Image
2/ The laundering path for the incident can be described as:

1) Transfer $1.3M to theft address
2) Bridge $1.3M from Solana to Etheruem via deBridge
3) Deposit 50.2 ETH to Tornado
4) Transfer 16.5 ETH to two exchanges

Theft address
6USfQ9BX33LNvuR44TXr8XKzyEgervPcF4QtZZfWMnet Image
3/ Using multiple payment addresses for 21 devs I was able to map out a cluster with the most recent batch of payments for ~$375K over the last month.

0xb721adfc3d9fe01e9b3332183665a503447b1d35

In the past week you may have seen me tagging projects telling them to DM me. Image
Read 7 tweets
Jul 18
1/ So I began tracing the $230M+ WazirX hack back from the original exploiter address and was able to make some interesting observations.
Image
2/ The theft address I will start from is 0x6ee which was doing test transactions on July 10th from 0x09b multisig with SHIB and was funded with 6 X 0.1 ETH from Tornado.

0x6eedf92fb92dd68a270c3205e96dccc527728066

A technical breakdown of the attack by Mudit can be found below

Image
Image
3/ With the 6 X 0.1 ETH withdrawals from Tornado Cash on July 10th I was able to demix this and find 6 X 0.1 ETH matching deposits made the day before.

0xc6873ce725229099caf5ac6078f30f48ec6c7e2e

The demix is accurate as 0xc68 was also doing tests with 0x304 multisig on July 9th with SHIB.Image
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(