Incident B
Inactive Wallet Tampering
Last updated
Inactive Wallet Tampering
Last updated
On January 11th 2024, 9:14:08 PM, the controller "ufwij-jggzv-owfkb-cs26m-p7j3y-awpqg-3oa33-x4ciu-vadlo-2jb7f-gae", hereon referred to as "ufwij", upgraded the Motoko Ghost Canister, "oeee4-qaaaa-aaaak-qaaeq-cai".
This was followed, 17 seconds later, on January 11th 2024, 9:14:25 PM, by 54 transfers from the wallet "c82b98eea65962e61ba3b28ef2e7d35bbfd5b373348b19e90c4d2b6f04a3157c" (Notably, this is the largest initially allocated wallet, of 293 NFTs, although having already sold 239) to "0576f2501fbda64f2b3d9bb85a01552d704eba9898707dc6eaa45e4cec49efcd" until 9:15:47 PM, 1 minute and 22 seconds later, which has been inactive since it's last transaction: 2022-05-05, 9:30:07 PM:
"0576f2501fbda64f2b3d9bb85a01552d704eba9898707dc6eaa45e4cec49efcd" proceeded to sell the 54 Motoko Ghosts over the course of 8 days, for a total sum of 4017.77 ICP, which was sent to a centralized exchange (indicated by the abundant transactions and large transaction quantities) in the following transactions:
The next day, on January 12th 2024, 7:17:22 AM, the controller "ufwij" once again upgraded the Motoko Ghost Canister.
This was followed, 17 seconds later, on January 12th 2024, 7:17:39 AM, by 20 transfers to the wallet "04cfda0917212904f8896fe8408e8eec31e6515755330151da6196114b9c6aaa" until 7:18:00 PM, 21 seconds later.
"04cfda0917212904f8896fe8408e8eec31e6515755330151da6196114b9c6aaa" proceeded to sell these Motoko Ghosts for a total of 1497.3 ICP - 1400 ICP of which was sent to a centralized exchange (indicated by the abundant transactions and large transaction quantities) in the following transactions:
On January 12th 2024, 7:18:02 AM, 2 seconds later, 20 transfers were made to the wallet "11f26f1b8da7e3b1aed9dfc8c597a973d510edb5c6c40574099cd53d3acbd59c", until 7:18:33AM, 21 seconds later.
"11f26f1b8da7e3b1aed9dfc8c597a973d510edb5c6c40574099cd53d3acbd59c" proceeded to sell these Motoko Ghosts for a total of 1528 ICP - 1474.5141 ICP of which was sent to a centralized exchange (indicated by the abundant transactions and large transaction quantities) in the following transaction:
On January 12th 2024, 7:18:35 AM, 2 seconds later, 19 transfers were made to the wallet "8630e7f8795eb6aedcc79e11f096f8d317c9c5c3213b66600ea926596eff6d45", until 7:19:07AM, 32 seconds later.
"8630e7f8795eb6aedcc79e11f096f8d317c9c5c3213b66600ea926596eff6d45" proceeded to sell these Motoko Ghosts for a total of 1471 ICP - 1418 ICP of which was sent to a centralized exchange (indicated by the abundant transactions and large transaction quantities) in the following transaction:
It can be observed that a total of 4 upgrades were made to the canister by "ufwij" before the 5th upgrade on October 8th 2024, being the source code and reproducible build provided by Toniq Labs.
The reproducible build was then overwritten in a canister upgrade on November 11th 2024, which was followed by another 6 canister upgrades, concluding with the final on January 16th 2025, 3:18:22AM before the Motoko DAO was made the controller of the canister on January 16th 2025, 11:58:53PM, and previous controllers had their access revoked.
