非法资金流动案例研究：55M 网络钓鱼

非法资金流动案例研究：55M 网络钓鱼

案件背景

2024 年 8 月 20 日，一笔钓鱼交易牟利超过 5400 万稳定代币 DAI。被引流的地址是一个由 Gemini 资助的 vault ，相关的"Maker Vault Owner "地址是 0xf2b8。 网络钓鱼者诱使受害者（金库的原所有者）签署交易，将金库所有者更改为网络钓鱼者控制的地址，然后执行交易，将金库的资金抽走。

资金流分析

2024 年 8 月 20 日，受害者保险库的原所有者受骗签署了一份交易，将保险库所有者变更为钓鱼者控制的地址。大约五小时后，钓鱼者又发送了一笔交易，进一步将所有者更改为新的地址。在新地址完全控制金库 20 分钟后，它签署了一份交易，从金库中抽走了 5,500 万 DAI。

然后，在两个小时内，所有非法获得的 DAI 代币都被转移到了由钓鱼者控制的下游地址，而最初的地址则没有留下任何东西，金库的资金被抽干。共有六个下游地址直接连接到地址 0x5D4b（即与初始地址相隔一跳）。大部分 DAI 代币（4400 万个）直接转移到下游地址，1000 万个代币被交换为原生代币（3880 个）ETH，然后转移到地址 0x8cc5。交换使用的 DEX 是CoW 协议：GPv2Settlement。交换交易：0x7c63.

从原始地址 0x5D4b 到 1 跳下游地址的虹吸 DAI 资金流图。

将非法资金转移到 1 跳下游地址后，攻击者开始进一步将资金分批转移到更深的地址。在转移过程中，钓鱼者逐渐将下游地址持有的 DAI 换成 ETH。在距离初始地址 4 跳的下游地址，所有被盗 DAI 都已被换成了 ETH。这些以 ETH 形式存在的非法资产随后流入集中式交易所（eXch、KuCoin、ChangeNOW）和跨链桥接器（THORChain、Hop Protocol）。(点击名称查看这些套现地址。）向 eXch 存入非法所得的交易实例：0x2e42, 0xa982, 0x1e1e, 0xb7a9.Examples of transactions moving illicit gains to THORChain: 0x5c06, 0xf824, 0x391e.

部分资金从第 2 层地址（距离初始地址 2 跳）流向第 5 层地址：

在非法所得向深下游地址的转移中，最长的转移路径达到 12 跳，约 8 万美元被转移到交易所KuCoin 17。如下资金流图所示，在 2024 年 8 月 21 日至 8 月 22 日期间，攻击者通过 12 跳的路径向中心化交易所逐步转移了 38 个 ETH。

为了避免大额转账引起过多关注，犯罪者倾向于将大额资金拆分到多个地址，并利用小额转账将资产转移到更深的地址。将 165 万 DAI 拆分成 36 小块，由 1 跳地址 0x860c 处理的示例：

一些相关地址和交易

| 地址 交易 非法资金流动 | :----------------------------------------:| :----------------------------------------------------------:| :----------------------:| | 0x860cf33bdc076f42edbc66c6fec30aa9ee99f073 | 0xa11e, 0x9ef1 | 1,650,000 DAI | | 0xdd6397104d57533e507bd571ac88c4b24852bce9 | 0x7af2, 0x1d45| 36,733,858 dai | 0x8cc568, 0x1d45 | 0x8cc568f3565a7ed44b3b0af8765a7ef67b8bc2dc | 0x7e10, 0x5d08| 3879 eth + 1,825,000 dai | 3879 eth + 1,825,000 dai | 0xca6061c6e5a7c3657297f9cc45ce110dc4d14470 | 0xee0d| 875 ETH | 0x77b9f7e33e42b1f64b915bb27e9a9bca199da83e | 0xf97a, 0xbc5c | 2164 ETH |

资金流概览：

Explore details in MetaSleuth: https://metasleuth.io/result/eth/0x5d4b2a02c59197eb2cae95a6df9fe27af60459d4?source=c81289c1-2bd9-49af-a397-e4cc71990595.

Sign up for the latest updates
#1 Cetus Incident: One Unchecked Shift Drains $223M in the Largest DeFi Hack of 2025

#1 Cetus Incident: One Unchecked Shift Drains $223M in the Largest DeFi Hack of 2025

Cetus Protocol, the largest concentrated-liquidity DEX on Sui, was exploited on May 22, 2025, resulting in an estimated ~$223M loss across multiple liquidity pools. The attacker leveraged a flaw in checked_shlw(), a custom overflow-prevention helper used in fixed-point u256 math, where an incorrect constant and comparison failed to block unsafe left shifts and caused silent truncation of high bits during liquidity delta calculations. By crafting specific liquidity and tick/price-range parameters, the exploit made required deposits appear near-zero while minting an oversized liquidity position, which was later withdrawn to drain real pool reserves.

#2 Bybit Incident: A Web2 Breach Enables the Largest Crypto Hack in History

#2 Bybit Incident: A Web2 Breach Enables the Largest Crypto Hack in History

The largest crypto hack ever, the February 21, 2025 Bybit breach stole about $1.5B after attackers used social engineering to compromise a Safe{Wallet} workflow, injected malicious JavaScript into an AWS S3 bucket, tampered with the transaction signing process, and upgraded Bybit’s Safe{Wallet} contract to a malicious implementation that drained funds across multiple chains.

Weekly Web3 Security Incident Roundup | Jan 25 – Feb 1, 2026

Weekly Web3 Security Incident Roundup | Jan 25 – Feb 1, 2026

During the week of January 25 to February 1, 2026, six blockchain security incidents were reported with total losses of ~$18.05M. These involved improper input validation, token design flaws, key compromises, and business logic errors across DeFi protocols on multiple chains. The primary causes included unchecked user inputs enabling arbitrary calls, flawed burn mechanisms allowing price manipulation, compromised developer tools, and missing solvency checks in lending functions.