KuCoin Attack Update: Hackers Use Uniswap to Dump OCEAN and Synthetix

Blockchain researcher Larry Cermak has been following the transactions in a thread on his Twitter handle. As shown in this Etherscan link, the hackers started off with OCEAN, transferring 200,000 tokens into a wallet before swapping them for ETH via Uniswap. In total, they unloaded 130,000 OCEAN in 13 batches of 10,000 tokens each.

Looks like the KuCoin hacker started using Uniswap to swap from shitcoins to ETH. Started with OCEAN. AFAIK this is the first time Uniswap is used following a hack

Steps:

1. From 0xeb….c23 to 0x1c…814 to 0x9e…E6b
2. 0x9e…E6b now slowly dumping OCEAN to ETH in 9 tx's https://t.co/BN5f1BN7V9

— Larry Cermak (@lawmaster) September 27, 2020

KuCoin Hackers Dump OCEAN and SNX

Following an apparent loss of liquidity in the OCEAN/ETH trading pair, the hackers briefly paused the dumping, only to continue shortly after. These developments likely contributed to tanking the OCEAN/ETH pair by nearly 13% in just two hours:

Acting to protect its users, OCEAN Protocol announced that it had paused the OCEAN contract, making trades impossible. In doing so, the hackers were prevented from dumping more OCEAN tokens and tanking the price even further.

As a first action to protect Ocean token holders, we have paused the OCEAN contract. We will update the community with more information in the coming hours.

Thank you for your support.

— Ocean Protocol (@oceanprotocol) September 27, 2020

Shortly thereafter, the attackers moved on to dumping Synthetix tokens, of which they had over 578,000 in their possession. This had a similar effect on the SNX price, which fell from just under $5.50 to as low as $4.70 in just two hours:

Just the Beginning

As Cermak pointed out, the hackers still have vast amounts of ERC-20 tokens in their possession which are all at risk of Uniswap dumps. Apart from the expected negative effect on the prices of these assets, Cermak says that it also potentially raises the specter of regulatory attention on Uniswap, which is, in theory, completely decentralized and impervious to all non-consensus action.

These are the ERC-20 tokens hacker has now sorted by USD value. Watching these closely as they can be next if Uniswap has liquid markets for some of them. Market participants might also front run then hacker and start dumping themselves. Some interesting dynamics playing out pic.twitter.com/7iKB83buYm

— Larry Cermak (@lawmaster) September 27, 2020