Earlier this year, Japanese cryptocurrency exchange Coincheck was hacked for roughly $534 million worth of NEM in what was described as the “biggest theft in crypto history.” Some of the stolen tokens may have now been traced to cryptocurrency exchanges in Canada and in Japan.
According to researcher BIG Blockchain Intelligence Group, some of the funds were sent to a Vancouver-based cryptocurrency exchange. There, they are being converted to other cryptocurrencies, meaning the hacker(s) are cashing out.
Shone Anstey, BIG’s president and co-.founder, refused to reveal the name of the exchange, the amount of stolen tokens that ended up in there, or where they were then going. As Bloomberg reports, Anstey revealed his findings were sent to law enforcement.
Per his words, it was the size of an NEM transaction that allowed BIG to get to the Vancouver-based exchange. The company reportedly used a combination of blockchain data with proprietary “know how” in its investigation. He said:
“We felt it was a significant amount that warranted looking into. They are trying to move it before the door is closed, but there is a lot to move.”
On the other hand, Akahata, the newspaper published by the Japanese Communist Party, claims 24 million NEM tokens ended up on Japanese exchange Zaif. Zaif, according to available data, is currently the biggest NEM market with 26.9% of the trading volume in the last 24-hour period.
Following the heist, the NEM development team added a tagging system to alert cryptocurrency exchanges the funds were stolen. The tag stated “coincheck_stolen_funds_do_not_accept_trades : owner_of_this_account_is_hacker.” At the time, Coincheck identified 11 addresses belonging to the hackers, and they were all tagged.
Cryptic message found in NEM transactions
The tagging system would easily allow cryptocurrency exchanges to prevent hackers from cashing out. Out of the 11 identified addresses, 6 have been moving small amounts of NEM since January. The transacted amounts range from 1 to 10,000 tokens.
Some of these transactions seemingly carried a cryptic message, which according to Bloomberg, is written in “awkward Japanese.” The message reads:
“This purchase is to determine the bitcoin address of the criminal, insist that the purpose is not for self profit.”
The other 5 addresses have been making large transactions of up to 20 million NEM. Some of these transactions likely ticked off BIG.