Nexus Mutual Hacker Now Demanding $2.7 Million Ethereum Ransom

Key Takeaways

  • On Dec. 14, the Nexus Mutual founder was hacked for $8 million NXM tokens.
  • The KYC-documents, Reddit conversations, and IP tracking unearthed a few clues, but the attacker has been unaffected.
  • Meanwhile, the hacker has laundered nearly $3.2 million and now demands another $2.7 million for the remaining wNXM tokens.

Share this article

The Nexus Mutual hacker sent a direct message to Hugh Karp’s Ethereum address this morning, demanding 4,500 ETH worth ($2.7 million) in exchange for the remaining loot. 

Nexus Mutual Hacker Unloads on DEXes

The price of Nexus Mutual’s NXM tokens has dropped 15% since the hack. The perpetrator now intends to wait for price recovery before unloading the rest. 

Wrapped Nexus Mutual (wNXM) price chart. Source: CoinGecko
Wrapped Nexus Mutual (wNXM) price chart. Source: CoinGecko

While waiting, the hacker has asked the Nexus Mutual founder, Hugh Karp, for a $1.7 settlement to return the remaining loot.

Immediately after the incident on Monday, the attacker converted the KYC-ed NXM tokens to Wrapped NXM (wNXM) on Ethereum, using decentralized exchanges 1inch and Matcha

Later, the perpetrator laundered $2.7 million, converting wNXM to 137 renBTC stored in two addresses

Gemini join the crypto exchange

During the 12-hour deadline, Hugh Karp placed on the entity to either return the funds for a $300k bounty or face legal consequences. 

The attacker has displayed a total disregard for Karp’s threats. 

Brave or Stupid? 

Today, the assailant converted another $500,000 wNXM into Ethereum and has paused for price recovery before unloading more. The attacker used Tornado Cash, a privacy tool for masking Ethereum transactions, and 1inch exchange to convert wNXM to ETH. 

The leftover wNXM tokens, worth nearly $4.5 million, are still at the hacker’s disposal. 

Read More