ChainCatcher message, SlowMist monitoring shows that earlier today, the BXH exploiters began to act after lying in wait for several months, consolidating a total of 9,491 ETH into a new address, and then quickly transferring it to Tornado.Cash.

ChainCatcher news, the blockchain security company Bit Jungle stated in a public account that on December 29, 2022, Bit Jungle assisted local police in successfully solving the case of stolen BXH digital assets. On September 21, 2022, the suspects Zhang, Hu, Sun, and Lin formed a gang in Zhengzhou and stole digital assets worth tens of millions of RMB by hacking into the BXH project server and implanting a Trojan.Now all four suspects have confessed, and some of the stolen digital assets have been returned. The police are continuing the interrogation and tracing of the stolen assets. (source link)

Chain Catcher news, early this morning, Slow Mist monitored that the funds from the first theft of BXH have shown new movements. According to the analysis by Slow Mist's MistTrack, the details of the movements are as follows:The hacker address 0x48c9...7d79 transferred part of the funds (213.77 BTCB, 5 BNB, and 1 ETH) to the new address 0xc01f...2aef, and then exchanged the funds for renBTC to cross-chain to the BTC network. After the cross-chain, the address is 1JwQ...u9oU. The total funds received by 1JwQ...u9oU during this transfer amount to 204.12 BTC. As of now, there are a total of 4 hacker addresses in the BTC network related to the first theft of BXH, with a total balance of 2701.3 BTC, which has not been further transferred yet.

Chain Catcher news, BXH has released a buyback plan in response to the previous theft incident, planning to buy back 5% of VToken on September 27. Users need to submit their staking wallet address along with the corresponding public chain, contact email, and the types and quantities of VToken currently held via email.It is reported that BXH was stolen on the evening of September 21, with a total of assets worth 2.5 million USD and 38 million BXH tokens. (source link)

According to Chain Catcher news and analysis by Slow Mist's MistTrack, the private key of the original owner of the BXH VaultPool contract is suspected to have been stolen. The hacker called the inCaseTokensGetStuck function to transfer funds from the contract to their address, which is 0x158f...e345. As of now, the hacker has exchanged the stolen funds across chains to the ETH chain and further transferred all the stolen funds to Tornado Cash, totaling 1865 ETH.Previously reported, the BXH Ben Xiaohai team announced on September 23 that assets worth a total of 2.5 million USD and 38 million BXH tokens were stolen on September 21.

ChainCatcher news, SlowMist monitored unusual activity of stolen funds from BXH in the early hours of September 4. According to SlowMist's MistTrack analysis, the details of the unusual activity are as follows:On the BSC chain, hacker address 0x48c9...7d79 approved Cake Token for PancakeSwap.On the ETH chain, hacker address 0x48c9...7d79 withdrew 3987.78 WETH as ETH.On the ETH chain, hacker address 0x4967...Eb35 used Uniswap and Curve to exchange all DAI for renBTC and WBTC, with totals of 858.0454 renBTC and 795.2618 WBTC after the exchange; among them, 858.0454 renBTC(valued at approximately 17.01 million USD) has been fully cross-chained to the BTC chain, with the cross-chain address being 1DYR...heSF. Currently, there has been no further transfer of BTC.As of now, the stolen funds from BXH have not been transferred to any exchanges, and all stolen funds remain in the hacker's address. SlowMist's MistTrack will continue to monitor the transfer of the stolen funds.