Crypto investigator ZachXBT has uncovered the suspected perpetrator behind the PrismaFi breach, revealing their role in the $11.1 million embezzlement and subsequent ransom demands.

In a sequence of revelations, blockchain detective ZachXBT exposed an alleged culprit involved in the PrismaFi exploit, which drained the protocol of $11.1 million in cryptocurrency. Identified as 0x77 (also known as Trung), the exploiter is potentially linked to multiple other illicit activities.

The Prisma team detected a series of suspicious transactions on the MigrateTroveZap contract in early March, resulting in a loss of 3,257 ETH, equivalent to $11.1 million at that time. Initially, the attacker engaged with the Prisma deployer, asserting that the breach was a benevolent whitehat endeavor. However, all misappropriated funds were eventually funneled into Tornado Cash, a sanctioned crypto mixing service.

Subsequently, the exploiter escalated the situation by making brazen demands, including a $3.8 million (34%) whitehat reward—significantly surpassing the industry norm of 10%. ZachXBT highlighted that this demand essentially amounted to extortion, considering the inadequacy of the treasury to reimburse affected users.

Further scrutiny unveiled that the exploiter’s address received funds through FixedFloat and was subsequently traced to Arbitrum, an Ethereum layer-2 solution. Through meticulous timing analysis, ZachXBT established connections between the exploiter’s address and withdrawals on TRON, including those from the Bybit exchange.

Moreover, the investigation unearthed ties to prior breaches, such as the Arcade_xyz incident in March 2023 and the Pine Protocol breach in February of the current year. Operating under the moniker 0x77 on Telegram, the exploiter maintained an active presence, with affiliations to the deployer of @modulusprotocol, reinforcing the interconnected nature of these events.

In a proactive move, the investigator divulged conducting a thorough analysis of the exploiter’s personal details, including phone numbers and emails, indicating a proficient technical acumen. All collected personal data has been relayed to the Prisma team, who are pursuing legal recourse against the hacker in Vietnam and Australia, as disclosed by ZachXBT.