US Government Crypto Wallet Drained of $20 Million in Suspicious Transfers

[31/10/2024]
A U.S. government wallet tied to the Bitfinex exchange hack was drained Thursday in what an analyst described as likely theft.

Over $20 million in stablecoins and Ethereum were transferred Thursday from a U.S. government-seized wallet containing assets tied to the 2016 Bitfinex hack. The funds, moved to a newly-created address, have raised suspicions of possible theft, according to on-chain analysts.

Blockchain analytics firm Arkham Intelligence reported activity from the government-linked wallet, noting significant withdrawals from the lending protocol Aave. This marked the first movement of these funds in eight months. Arkham reported that $1.25 million in Tether (USDT) and $5.5 million in USD Coin (USDC) were withdrawn and sent to a wallet beginning with "0x348," along with $446,000 in Ethereum (ETH) and $13.7 million in aUSDC, a token representing USDC deposited in Aave.

Some of the funds have since been moved to instant exchanges, including one sourcing liquidity from Binance, the world’s largest crypto platform. Blockchain analyst ZachXBT, known for tracking illicit crypto activity, flagged the transactions as potentially “nefarious,” suggesting a theft had likely occurred.

Bitfinex was previously hacked in 2016, resulting in the seizure of digital assets now valued at $3.6 billion, linked to New York residents Ilya Lichtenstein and Heather Morgan. The couple later pled guilty to money laundering conspiracies related to the hack, as confirmed by a Department of Justice press release from August 2023.

Following Thursday’s transfer, the wallet receiving the assets used 1inch, a decentralized exchange aggregator, to convert stablecoins to Ethereum. The Ethereum was subsequently moved in $40,000 increments to a deposit address associated with Binance, with ZachXBT describing these transfers as unusual. Approximately $320,000 in Ethereum was sent to an exchange address, while $80,000 was dispersed into separate wallets. ZachXBT clarified that these transfers may have gone to a "nested exchange" rather than directly to Binance, which merely served as a liquidity source.

Interestingly, the "0x348" wallet, which conducted its first transaction just days prior, was funded two years ago by the Australian exchange CoinSpot, which operates exclusively in Australia. By the time of this report, the government-held wallet had been emptied, save for $127 in a meme coin featuring former President Donald Trump. The DOJ has yet to comment on whether these movements are related to ongoing law enforcement activities.

Theo Decrypt