Is the transfer of Multichain's $120 million assets a "hacking attack"?

Multichain, whose TVL is as high as 1.4 billion US dollars, has been leaking recently and it has been raining overnight.

In May 2023, the CEO of Multichain lost contact, and in June, the cross-chain service of part of Multichain's network was suspended. In the early morning of July 7th, Beijing time, multiple cross-chain bridges of Multichain had serious problems again. The Multichain Fantom Bridge and Moonriver Bridge were attacked by "hackers", and about 120 million US dollars of assets were transferred.

What exactly happened?

At around 0:20 am on July 7, 2023, the "hacker" began to attack the Multichain bridge, and calmly transferred about US$120 million in assets from the Multichain Fantom bridge and Moonriver bridge to the following 6 addresses within 3.5 hours.

The transferred assets include: 62.6 million USDC, 1030 WBTC, 7214 WETH, 5 million DAI, 0.91 million UNIDX, 491,000 LINK, 2.5 million USDT, 9.7 million WOO, 1.3 million ICE, 1.36 million CRV, 134 YFI, 502,000 TUSD.

The cryptocurrency analysis tool MetaSleuth visualized the stolen asset transfer as a guest, as shown in the figure below:

After the incident, Multichain tweeted, "The locked assets on the Multichain MPC address were abnormally transferred to an unknown address. The team is not sure what happened and is currently investigating." . . "All users are advised to immediately apply for a refund and revoke application approval for Multichain."

"Hacked" or in doubt

Multiple evidences show that the transfer of Multichain assets may not be a simple "hacking" attack.

Golden Finance reporter found that:

1. The "hacker" conducted two small tests of 2USDC before the asset transfer, which shows that the "hacker" transferred assets more calmly.

2. The 6 wallets where the assets are received are very clean, and there is almost no ETH used for gas fees at all.

3. There are still 180 million USDC, 27,000 ETH, 1233 BTC, 50 million USDT, etc. on the Fantom bridge of Multichain. The "hacker" has not transferred any further assets, and the Fantom bridge of Multichain should be operating normally.

4. The so-called "hacking" attack method of Multichain this time is very simple, that is, a simple transfer. After the transfer to the new address, it is not issued for the next step of disposal and realization.

Considering the technical characteristics of MPC, the "hacker" is likely to gain control of private key shards exceeding the threshold in some way. The security agency Certik also stated after analyzing the Multichain bridge’s asset transfer event, “(Multichain) this vulnerability seems to be the result of a private key leak, so it is beyond the scope of our audit.”

According to the names of the 21 MPC node operators of Multichain, multiple node operators of Multichain may be located in China.

Combined with the news that Multichain CEO Zhao Jun was detained by the Chinese police in May and lost contact, it is very likely that MPC-related node operators transferred relevant assets to police-controlled wallets at the request of the police.

Multichain Bridge problems continue

The Multichain Bridge, formerly known as Anyswap, is an MPC bridge consisting of 21 nodes. The transfer of funds across the chain bridge requires a combination of nodes exceeding the threshold to sign and authorize.

Multichain was previously hacked for $8 million in 2021. In early 2022, multiple hackers stole $3 million from Multichain, and a white hat hacker later returned $900,000.

In 2023, Multichain once again encountered serious problems.

On May 24, several community users reported that there was an abnormal delay in the arrival of Multichain cross-chain funds. On May 25, Multichain issued a document stating that due to force majeure, some cross-chain routes cannot be used, and the time to restore services is unknown.

Community rumors followed that Multichain CEO Zhao Jun was detained in China and therefore lost contact with him.

On June 1, Multichain issued a document stating that it could not contact CEO Zhao Jun to obtain the necessary server access rights, and would suspend cross-chain services on some networks.