The founder of Indexed Finance claims to have confirmed the hacker's true identity, which is an 18-year-old teenager

Author: Gu Yu, Chain Catcher
The DeFi asset management protocol Indexed Finance attack incident has new developments. According to its founder Dillon Kellar, the hacker behind the attack is actually an 18-year-old teenager.
Indexed Finance is a DeFi asset management project built on Ethereum, aimed at issuing tokens that track market indices. The aforementioned hacker exploited a smart contract vulnerability through a flash loan attack on October 15, causing the market prices of DEFI5 and CC10 (both index tokens tracking leading DeFi projects) to plummet significantly, and then withdrew the actual supporting assets of these index tokens for sale, profiting over $16 million.
Currently, the prices of the project's DEFI5 and CC10 index tokens have both dropped by over 95%. The price of the project's token NDX has fallen by more than 40%, from $3.4 to $2.17, and has now rebounded to $3.
The day after the incident, Indexed Finance officially stated that the hacker's associated address had received transfers from a Binance address and had transferred to a Coinbase address. They are seeking the hacker's KYC information from both exchanges and publicly requested the hacker to return 90% of the stolen funds to a specific address by 17:00 UTC on October 17, or else their information would be disclosed and law enforcement would be notified.
Meanwhile, the project's developer @laurenceeday wrote that they already know who executed the attack and had even communicated multiple times with the account disguised as the hacker before the attack, but did not detect any malicious intent.
"Starting from September 15, a Discord user named 'UmbralUpsilon' (currently BogHolder#1688) contacted us, asking questions about how to use certain parameters in the oracle. Since every component of Indexed is open source, we answered these questions and were told he was trying to create an arbitrage bot for the mining pool after inquiring about the reasons." @laurenceeday stated, "We were happy to engage in queries about the mechanism, explaining how Indexed works, and we had no reason to feel alarmed: all these conversations were in the spirit of open-source collaboration."
After the deadline, Indexed Finance tweeted that the ultimatum did not work and realized that the attacker was younger than expected, deciding to reassess the next steps, which means not disclosing the hacker's specific identity information for now.
According to the project's founder Dillon Kellar on Discord, this hacker is actually just an 18-year-old teenager. "We thought he was 23-24 years old, but it turns out he is just a very smart teenager."

"We know who he is and where he is, but we won't publicly 'beat up' an 18-year-old kid and bombard him with death threats." Dillon Kellar said, "In any case, we will find a new way forward with legal counsel."
In response to some criticisms directed at the team, the project's founder Dillon Kellar also stated on Discord that the core team only maintains and works on the website and writes contracts for DAO review. "We do not own the protocol, we do not vote in the governance of the protocol, and we certainly are not responsible for the vulnerabilities that occur on the smart contracts."
Currently, there are no further updates on the incident, and Chain Catcher will continue to track related developments.