Upbit Theft

Live Tracking of Bad Actors' Money Movement

On 27 November, 2019, 342,000 ETH was moved from Upbit's Hot Wallet to an unidentified, suspicious wallet.  Upbit has acknowledged the transaction to be an abnormal and unauthorized one, classifying it as theft.

Harnessing the power of data intelligence in our Threat Reputation Database, coupled with our Transaction Tracking Visualization tool - CATV, Uppsala Security is able to aid Crypto Exchanges and interested parties in investigating, tracking and denying the bad actor's efforts to encash the stolen funds through exchanges.

Dashboard for Upbit Theft Incident
342,000
Ethereum
stolen
~$52 M
US Dollars
worth of ETH
49451
Suspicious Wallets involved
158410
Transactions related to Suspicious Wallets
Pull Updates
10
# Exchanges reached by stolen funds
Binance 

(0x31932e7fd5e7265180bb085ccf9867fddc106be3)
(0xd8ce1addb79b03389504b4ffd7d521c5f494681b)
(0x742E92d356Ae3FEC4B602eebC5A78bc3fEc88e4e)
(0x2B9a95C4f3924465FdBcDeD0A79Cbd879830a04F)
(0x2ecb7cf6a9a05773ed759d42e603dcb9aafffe6f)
(0x2Bc3678d93E7C82Bc37Cc951B608cA5adE962e2B)
(0x20e3a9cf9f2d4773de24fb50b1eff25fed70acc3)
(0x2ec40a6A3cCA5E67C650051A41a4B51F590063CC)
(0x2ec6BDeCCbdec4657127b76B9FF74143CFe021D5)
(0x2bc812c70dcd634a07ce4fb9cd9ba4319fd9898d)
(0x3468Ea24CaCB1173a858eaC4aB3be60eCbba8a34)
(0xaf486c8af85df8e38b48f8ae0b43550c70a018bc)

Huobi 

(0xb28Bc69199A7ABF00B9Cb200356104cE1bDc4868)
(0x54c892fe1b7adaa4c1d35af029db4abfeaf97e0c)
(0xad517717012aaf8bbbbdc4c11cf9c55c03e51d08)

Switchain

(0xA96b536eEf496e21F5432FD258b6F78CF3673F74)

60cek

(0x69FfE5736e8C4053A48F03CBb58E9dD304db5945)

LATOKEN

(0x199f6a3f4748023819649580f171a823b26af792)
(0x11c94a7a8fd1079cecedfd83943291134b7a2c82)
(0x622ac3f3e0e57c6ac06b3fc67c845dd309084861)
(0x0A2D85e7Ae482F782c9f76cAc83BDe60F035eFdA)
(0xCAD6050be46f2d83a38843A209eFE2Ed9aF75825)
(0x6945977bd770C2eC1E7F4786b075b6129Db3e493)
(0xa65989400e04050882d6456919d723266fe2a3a9)
(0xec91d81c4410cb27a8b39256cb974bca30c8b515)

Bit-Z

(0xc1292D5598A4887b8Eb5A557688f21f8f9661bCF)

Bittrex

(0x7e5C71D6a90b0e3051b0780579A84e125F9BF39d)

Bilaxy

(0x1C8A15A49F2806bDD8D76C32F38462F89ca8ca67)

ZB

(0xa89509bebfd26c3651bb2c8a3571323bf6abed95)

Bitrue

(0x03b06736f7bbace341a25e19eb758efdb77c0395)
(0x55e5c96ca86b3bbd33e29c756c0785616fff6559)
Exchanges reached by stolen funds
Money Flow Visualization for Stolen ETH
Uppsala Security's  Crypto Analysis Transaction Visualization (CATV)  tool brings clarity into complex transaction flows through it's accurate flow illustrations and interactive interface. Making use of extensive crypto wallet information and threat intelligence from our Threat Reputation Database (TRDB), visibility into the transaction flow is further achieved.

Overall, CATV helps to facilitate easier and swifter investigations, paramount to keeping up with bad actors and preventing them from encashing dirty funds.
  • Blacklist
  • Whitelist
  • Exchange & DEX
  • Suspicious
  • Smart Contract
  • Annotated
  • No Tag
Most Recent Transactions made by Suspicious Wallets
Time (UTC) Tx Hash From To Amount (ETH)
2020-01-29 08:25:59 0x6fb31d9a6e97a2a072408555565b1bbcafe7b71e902a35e8668abcd25c2aa372 0x7f5d365e17a0755cb9e336460e12c7c42e869155 0x8024e337e7c432d17590b90df2ef1d6e76662816 0
2020-01-29 08:25:59 0xdb9fd02618cb52ffa2d9e021622a7e651495ee84137ddc46b823b04d06d25539 0x7f5d365e17a0755cb9e336460e12c7c42e869155 0x8024e337e7c432d17590b90df2ef1d6e76662816 0
2020-01-29 08:25:59 0xf221bd11547952e90396e018b4216d7c0bb5fc7305811625831ec2911ba2bb05 0x7f5d365e17a0755cb9e336460e12c7c42e869155 0xf90411621d108d163a0b6790c778945613bfa81b 0.022416
2020-01-29 08:25:59 0xb11a209c65e77c4b66facf8238240ed7128dbfec67f31437d136b6be6f20899b 0x7f5d365e17a0755cb9e336460e12c7c42e869155 0x8024e337e7c432d17590b90df2ef1d6e76662816 0
2020-01-29 08:25:32 0x3364e6a5d39e247bb4600cf8cf906efd00ef307f769f86c8905f9f543c53917f 0x3f02793f61252e075a1bd4de577d8288dfc6dc0f 0xcfcf469b76113c5e7218f8275eaf10a881ac106d 0.005948
2020-01-29 08:24:48 0x85eaa6d8a91bde70e48a7137148f4f0d49cedbaa80da072935b5adfcf20b7b95 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:24:48 0xc11e686891f2020520e35ad182aa4336ada2ec327c92f169cf9af601c277902d 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:24:48 0xfdcdea64a0086f9e8ea9183c8ae3c6315ef66e6cf57226b197b0900d7fa5e81f 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:20:39 0x76115296a7b581e4661c3ea6e5bcb8f88589c3c00fc12346e2bf9ef3883a0333 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x8ecac98ad033f467cfa9b083f894219e5ee4444b 0.016812
2020-01-29 08:19:20 0x9e287066ad4efd01287707b4779a6bdeb9925ce103079c6f730868e20196f45d 0xda0d1b7995e652288ac13540915b899a51d2be50 0x7668b699d44c0ae3511b26be5f81393475a2e091 0.003500
2020-01-29 08:18:53 0x7541edafce8397f73836cefbbf4969ddc70a218a92899452df4c1cc1da97cdd7 0xd9ee699014aefd7084033255af0cab02367c5b70 0x3f5ce5fbfe3e9af3971dd833d26ba9b5c936f0be 5.660737
2020-01-29 08:17:52 0x36b5b246e95226578508742f59f487083cf51d2d17be231dca25f61dfb4fbbb8 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:17:07 0x8c06fdde104fc1fb3cd6ea83665717ff6ed008f1c6c8c9712bb86538b4f63256 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:16:37 0xe29125954f6d5b243b308edbcaebffb86a952f545d272d9a8d2bbb3eee82fbf0 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:15:47 0x78d50225fbd690d46a40db41731ce52ed6f37c9ad00100d8124683185792e79e 0x36afee66ea8d6a99a9c6c7e676d512ea4a19bc83 0x05007434b72a5e99348186f45fcd3660917da683 0
2020-01-29 08:05:14 0x35ccfbd330884501d3c46d656082736f213cd64de63c3032852ac5a37a5b2daa 0x26cdd8e67b71858eef229280250db90598db68cd 0x6b214b2cd5e4f6bf31ec0e49449935a48d202f91 0
2020-01-29 07:58:33 0x82fb4e092c508812e64d12b96697fac44a643b6307eefb82ae8fc83345d6a601 0x140297e2a62241359d740ca84ce5e434419628f0 0x05cde89ccfa0ada8c88d5a23caaa79ef129e7883 0
2020-01-29 07:56:12 0x688dc958de9667529529a938232699351280c0cbdda5291759affca5c3214815 0xcb732c7aa236512d8e58a1785f6b5582038a724d 0x08403ab7e92c2d9043361dda03b3d489ff4b1dfb 3
2020-01-29 07:52:15 0x8c04a863943a110c9505c0d0e52659b2eb99a22e3650b8a148cacd4a0a71e81c 0x24cde618ef552364dd87ba1c9d75fa90a7ef5435 0xabe80343b9c0bf7b1d6181a435af9c2cb7f5f20b 0.010000
2020-01-29 07:50:46 0x6ebf7af47b32db38ee79edf1f6cc21bf9005a49fd67247ed65678182c1864ddd 0x2f89f32caa2de388a90cfad52bd7bd189440c23f 0x18f6bb93069af5051dc03ef00b65db5b24ea9eb9 0.912253
* Only 20 most recent transactions made by suspicious wallets will be shown. Parties interested to obtain the full list of tx can request it on our forum.

 Questions or insights to share? 
Head to our forum to join the discussion today.