--- title: Hack Track | Hack Track (2) description: Hack Track | Merkle Science Hack Track provides digestible insights on the movement of stolen funds from the latest cryptocurrency heists. (2) --- # Hack Track ![](https://blog.merklescience.com/hubfs/Hacktrack%202%20%281%29.png) [#News](https://blog.merklescience.com/hacktrack/tag/news), [cryptocrime](https://blog.merklescience.com/hacktrack/tag/cryptocrime), [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track), [decentralized finance](https://blog.merklescience.com/hacktrack/tag/decentralized-finance) ### [Hack Track: Mixin Flow of Funds Analysis](https://blog.merklescience.com/hacktrack/hack-track-mixin-flow-of-funds-analysis) Sep 27, 2023 2:03:43 PM Mixin Network, a Hong Kong-based digital asset transactional platform, reported a security breach on [25 September](https://x.com/MixinKernel/status/1706139175018529139?s=20), revealing a loss of approximately $200 million due to a hack of its cloud service provider. The stolen funds accounted for so far are comprised of ETH, USDT (swapped to DAI), and BTC. If the $200M figure stated by Mixin is accurate, it would make this incident the biggest hack of 2023 so far. [Read More](https://blog.merklescience.com/hacktrack/hack-track-mixin-flow-of-funds-analysis) ![](https://blog.merklescience.com/hubfs/Hacktrack%202-1.png) [cryptocrime](https://blog.merklescience.com/hacktrack/tag/cryptocrime), [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Stake Suffers $38 million Hack](https://blog.merklescience.com/hacktrack/stake-suffers-38-million-hack) Sep 5, 2023 2:12:06 PM On the 4th of September 2023, the popular crypto gambling platform Stake suffered a major security breach due to private key leak resulting in the theft of approximately US $38 million.  The preliminary investigation confirms that unauthorized withdrawals were detected from Stake's hot wallets on the Ethereum, Polygon, and Binance Smart Chain networks. [Read More](https://blog.merklescience.com/hacktrack/stake-suffers-38-million-hack) ![](https://blog.merklescience.com/hubfs/Hacktrack%201-1.png) [cryptocrime](https://blog.merklescience.com/hacktrack/tag/cryptocrime), [Crypto](https://blog.merklescience.com/hacktrack/tag/crypto), [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track), [decentralized finance](https://blog.merklescience.com/hacktrack/tag/decentralized-finance) ### [Hack Track: Zunami Flow of Funds Analysis](https://blog.merklescience.com/hacktrack/hack-track-alphapo-flow-of-funds-analysis-1) Aug 17, 2023 11:54:37 AM On the 13th of August 2023, at around 10:30 pm UTC, [Zunami](https://www.zunami.io/) Protocol suffered a price manipulation attack and lost approximately $2.1 million. [Read More](https://blog.merklescience.com/hacktrack/hack-track-alphapo-flow-of-funds-analysis-1) ![](https://blog.merklescience.com/hubfs/Hacktrack%20Steadefi.png) [#News](https://blog.merklescience.com/hacktrack/tag/news), [cryptocrime](https://blog.merklescience.com/hacktrack/tag/cryptocrime), [blockchain](https://blog.merklescience.com/hacktrack/tag/blockchain), [Crypto](https://blog.merklescience.com/hacktrack/tag/crypto), [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track), [decentralized finance](https://blog.merklescience.com/hacktrack/tag/decentralized-finance) ### [Hack Track: Steadefi Flow of Funds Analysis](https://blog.merklescience.com/hacktrack/hack-track-steadefi-flow-of-funds-analysis) Aug 8, 2023 9:06:00 PM On August 7th, 2023, Steadefi, a sophisticated yield aggregator, fell victim to an assault that resulted in a substantial loss of over $1.14 million. [Read More](https://blog.merklescience.com/hacktrack/hack-track-steadefi-flow-of-funds-analysis) ![](https://blog.merklescience.com/hubfs/Hacktrack%201.png) [cryptocrime](https://blog.merklescience.com/hacktrack/tag/cryptocrime), [blockchain](https://blog.merklescience.com/hacktrack/tag/blockchain), [Crypto](https://blog.merklescience.com/hacktrack/tag/crypto), [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Hack Track: Curve Finance Flow of Funds Analysis](https://blog.merklescience.com/hacktrack/hack-track-curve-finance-flow-of-funds-analysis) Aug 1, 2023 4:15:23 PM On the 30th of July, [Curve Finance](https://resources.curve.fi/#welcome-to-curve-finance), a decentralized, Automated Market Maker (AMM), was hacked leading to a loss of ~ $45 million in CurveDAO, ETH, and wETH. The attackers exploited a malfunctioning reentrancy lock on different versions of the Vyper programming language (0.2.15, 0.2.16, and 0.3.0) across multiple stable-pools. [Read More](https://blog.merklescience.com/hacktrack/hack-track-curve-finance-flow-of-funds-analysis) ![](https://blog.merklescience.com/hubfs/WhatsApp%20Image%202022-04-19%20at%203.53.58%20PM.jpeg) [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Hack Track: Analysis of Beanstalk Flash Loan Attack](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-beanstalk-flash-loan-attack-hack-track-merkle-science) Apr 19, 2022 11:58:29 AM On April 17, 2022, Beanstalk Farms, a decentralized credit-focused stablecoin protocol built on Ethereum, suffered an exploit. The attackers exploited Beanstalk’s governance protocol to extract[ $182 million](https://cointelegraph.com/news/beanstalk-farms-loses-182m-in-defi-governance-exploit) in collateral, around $80 million of which went to the hacker as profit. Beanstalk enables participants to earn rewards such as [Stalk and Seeds](https://bean.money/blog/introducing-beanstalk) by contributing to a central funding pool called the Silo. The participants receive [four Seeds](https://newsletter.thedefiant.io/p/-defi-alpha-264-apy-with-beanstalk?s=r) for every Bean stablecoin deposited in the Silo, which in turn, earns them 0.004 Stalk every hour. Stalks are ERC-20 standards tokens that bestow governance rights over the protocol to its holders and give holders voting power. Unlike Stalks, Seeds are not liquid and do not give voting rights to their holders.  [Read More](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-beanstalk-flash-loan-attack-hack-track-merkle-science) ![](https://blog.merklescience.com/hubfs/Ronin%20Network%20Hack-Banner.png) [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Hack Track: Analysis of Ronin Network Exploit](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-ronin-network-exploit-merkle-science) Mar 31, 2022 9:24:44 AM **[Update 2022.04.18]** On April 14, 2022, the U.S. Department of Treasury’s Office tied the North Korea-based hacking group, Lazarus, to the Ronin Network exploit. The Office of Foreign Assets Control (OFAC) [added](https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220414) an Ethereum wallet address (**0x098B716B8Aaf21512996dC57EB0615e2383E2f96) **associated with Lazarus to its sanctions list. The sanctioned wallet address contains funds stolen in the Ronin security breach. At the time of the publication, the wallet holds 138,433.136 ETH valuing close to $402 million. The Ronin Bridge was exploited for 173,600 ETH and 25.5 million USDC, worth around $568 million at the time of the transaction. The North Korean state-sponsored Lazarus group, has been [associated](https://www.cnbc.com/2022/04/15/ronin-hack-north-korea-linked-to-615-million-crypto-heist-us-says.html) with several major cyberattacks over the years, including a 2014 hack on [Sony Pictures](https://www.vox.com/2015/1/20/18089084/sony-hack-north-korea) and the 2017 [WannaCry](https://www.acronis.com/en-us/articles/nhs-cyber-attack/) ransomware attacks. The OFAC first imposed sanctions on Lazarus and two of its sub-groups ​​Bluenoroff and Andariel in September 2019. In the [announcement](https://home.treasury.gov/news/press-releases/sm774), the U.S. Department of Treasury stated Lazarus and its sub-groups are controlled by North Korea’s primary intelligence agency, the Reconnaissance General Bureau (RGB). In its [official update](https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w), the Ronin Network confirmed that the FBI has linked Lazarus to its validator security breach. Additionally, the Ronin Network also stated that it is “still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk.”  The bridge is expected to be deployed by end of April. ---   Around $568 million worth of crypto has been stolen from the Ronin Network, the blockchain underlying the popular crypto game Axie Infinity. The amount lost is calculated based on the ETH/USD price conversion rate on the date of the transaction — March 23, 2022.  On March 29, 2022, Sky Mavis, the creator of both Ronin and Axie Infinity, reported that the Ronin bridge had been exploited for 173,600 Ethereum (ETH) and 25.5 million USDC [Read More](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-ronin-network-exploit-merkle-science) ![](https://blog.merklescience.com/hubfs/Wormhole%20Blog%20assets.png) [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Hack Track: Analysis of Wormhole Token Bridge Exploit](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-the-wormhole-token-bridge-exploit) Feb 4, 2022 5:13:35 PM On February 2, 2022, the Wormhole Token Bridge, suffered an exploit, which resulted in the loss of 120,000 Wrapped Ether (wETH) tokens worth over $320 million at the time. Wormhole is a popular cross-chain bridge that links Ethereum and Solana blockchain. This is the largest crypto exploit of 2022 so far and the [second-largest](https://cointelegraph.com/news/wormhole-token-bridge-loses-321m-in-largest-hack-so-far-in-2022) decentralized finance (DeFi) attack to date. The attack happened amidst a rapid increase in hacking incidents suffered by DeFi platforms. In fact, according to a report by CertiK, which is a leading security-landing platform, the amount of money lost in the hack of DeFi projects more than doubled to [$1.3 billion](https://www.coindesk.com/business/2022/01/13/funds-lost-to-defi-hacks-more-than-doubled-to-13b-in-2021-certik/) in 2021. Of late, the attacks on bridge platforms are on the rise. The news of the Wormhole exploit comes shortly after the [Quibit Finance attack](https://blog.merklescience.com/hacktrack/analysis-of-qubit-finance-exploit), wherein the attacker took advantage of a logical error in Qubit’s smart contract to input malicious data to steal $80 million worth of cryptocurrency. Bridges between chains are often more susceptible to exploits as they require more interactions and contract approvals than the other [Read More](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-the-wormhole-token-bridge-exploit) ![](https://blog.merklescience.com/hubfs/AscendEX%20Hack%20Banner-1.png) [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Hack Track: AscendEX Attack Recent Fund Movement Analysis](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-ascendex-attack) Dec 16, 2021 1:46:09 PM **[Update 2022.02.18]** [Read More](https://blog.merklescience.com/hacktrack/hack-track-analysis-of-ascendex-attack) ![](https://blog.merklescience.com/hubfs/BitMart%20Hack%20Banner-2.png) [Hack Track](https://blog.merklescience.com/hacktrack/tag/hack-track) ### [Hack Track: Analysis on BitMart Hack](https://blog.merklescience.com/hacktrack/hack-track-analysis-on-bitmart-hack) Dec 8, 2021 12:24:16 PM On December 4, 2021, crypto exchange [BitMart](https://www.bitmart.com/) suffered an attack on its Ethereum and Binance Smart Chain hot wallets, resulting in a loss of nearly $200 million USD. Founder and CEO Sheldon Xia confirmed the incident, writing on [Twitter](https://twitter.com/sheldonbitmart/status/1467316252855226368): "We have identified a large-scale security breach related to one of our ETH hot wallets and one of our BSC hot wallets.” [Read More](https://blog.merklescience.com/hacktrack/hack-track-analysis-on-bitmart-hack)