An unknown person stole and sold a “huge amount” of tokens issued on the Ethereum platform Roll, said Igor Igamberdiev, a researcher at The Block. The attacker received almost 3,000 ETH (~$5.7 million).
He has already sent 700 ETH to the Tornado Cash mixer.
Roll allows any user to issue their own branded tokens on the Ethereum blockchain. He can use the asset to monetize activity within his community. The platform calls such coins “social money”.
The maximum issue of a token on a Roll is 10 million units. The user receives the first 2 million immediately, the remaining amount is issued within three years.
The affected address belongs to the platform, so the expert assumed either the compromise of the private key or the actions of an insider. It is unknown whether the attacker gained access to other elements of the Roll infrastructure, the researcher added.
The price of most of the tokens affected by the incident has dropped significantly.
There are a number of little-known coins left in the wallet, which the attacker can still implement, Igamberdiev noted.
Recall that the hacker who hacked the $14 million Furucombo DeFi project in Ethereum and ERC-20 tokens in February also actively used Tornado Cash to withdraw assets.
Earlier, Crystal Blockchain experts noted that over the past 5 years, mixers have become the second most popular destination for attackers to withdraw.