Note to Mods: This is an update to this post: https://www.reddit.com/r/CryptoCurrency/comments/11sksgs/i_got_hacked_and_lost_over_300k_today/. Please let me know if this is ok to proceed.

It's been a week since I lost access to 3 of my wallets totaling over 300k. Unfortunately, I was a victim of a cyber attack by a hacker who managed to drain away almost all of my life savings in the span of about an hour on March 15th.

Yes, I'm the big dum dum who left seed phrases on his Evernote account without 2FA losing over 80k of precious MOONs in the process =(

Tracking the Hacker

***ATTN: KuCoin** - You have a Hacker actively cashing out stolen crypto on your platform!

I appreciate the love and support I've received from this forum. Today the Hacker was on the move and went to a KYC Exchange to cash out some ETH.

Below are the known Hacker Wallet Address, all created in the last week.

• 0x73d663D2F64773453a5c0082486b0B6Cd6dBA247 [Wallet created today. Cashed out on KuCoin]
• 0x85690F09b37b5B5c27DA2f2996D0C19a83eb7164 [Wallet created today]
• 0x2c604c4bc582c7171ef4d1844cabffe34ba0bd4c [Wallet created 3 days]
• 0xe147a73e7d783166f791f10342a0122db80814c4 [Created a week ago - Used to drain my MetaMask]
• 0x8294b95d303949699167f7579c9da49f6359d4ff [Created a week ago - Used to hijack Rocketpool Node]

Tracing the movements of the Hackers wallets. The Coinbase accounts are me sending test transactions.

You'll find the above transaction on Etherscan here - https://etherscan.io/tx/0xae71dd0b56ed9cfdd902b8aba0983e32630aa8e259e453da1993911a520d2b23

But Wait, There's More on the Cardano Blockchain

We had a hunch that Kucoin was also used to cashout ADA on the Cardano network.

The hacker moved all ADA from my Deadalus staking pool to:

addr1q8lee9tt64w6uwj9xwne2hnca8x8e2vg87prhl43uqdhdgk232uaxahskg735wxx28xwrhjj97fhphnyz3ppn3fjpygsywcdlv

From there, the hacker moved all ADA to the following address:

addr1q9yf0jwvs4cjatuhwh6e6a9rxlrnc3c2r93e9su3s6vng670wa7lvmka8xl9d8xpj6hq9lkcc5d92362pw4cldul352sdm59zj

That wallet appears to be combined with a few other wallets where it ultimately lands here.

addr1q9h4f2vhh5vnqgnsejan3psw6mj3a504fxlqm2eh3262qufesdvfs83ulr22vprsv9mwnt0vgkfwxlflxkns32twqzdqjpq2na

The last address appears to be an exchange of some sort. I looked under "Associated Wallets" and noticed almost all inbound transactions are coming into KuCoin.

Feel free to check my work as I'm not as confident in tracing on the Cardano blockchain as the Ethereum blockchain.

All Roads lead to KuCoin

My hope for writing this post is to provide enough compelling evidence to freeze this Hacker's accounts. We have overwhelming evidence this person is using stolen funds (mine in this case) to cash out at a KYC exchange.

It's only a matter of time before this person's identity is revealed. We have an IP, we have a KYC exchange, and we have additional information to pass onto law enforcement.

And 1inch Protocol if your listening..

There's precedent of 1inch Protocol helping victims recover stolen funds based off their blog article 1inch helps recover $25M. The hacker used the wallet - 0xe147a73e7d783166f791f10342a0122db80814c4 to swap my VELA and GMX tokens on the Arbitrum One network using 1inch Protocol.

Here's one of the transaction's on Arbiscan - https://arbiscan.io/tx/0x8b325e0a758cf443e16f23ed2b8cf7471d7e86ac932f278e00da48b8aa8e5603

Thanks for reading and a special shoutout to u/Queasy_Length_1016 , u/zoomercoomer9000**,** and others who wish to remain anonymous. You know who you are! I'm hopeful this will come to a positive conclusion with the evidence collected.

I'll update this thread as more news comes in.