📍 Austin, TX, USA. on 9th Jun 2022 at 00:00
3 mins read
Listen to this article:
Would you put your anonymity at risk if that meant finding a multi-million dollar hacker?
That's what happened to thousands of Wasabi wallet users. They felt safe and secure, but around a month ago, a journalist called Laura Shin along with Chainalysis found a way around one of Wasabi's anonymity features.
While that sounds awful, it served a bigger purpose, namely, identifying the DAO hacker
Wasabi Wallet is one of the most prolific bitcoin digital wallets. It is an open-source wallet that offers privacy and anonymity services to its users. It is available in several operative systems. Wasabi claimed it was untraceable — even if the blockchain is entirely public.
Yet, something almost tragic for its users happened. Chainalysis found a way to interpret Wasabi's mixing procedures. If true, this would put at risk the anonymous features of Wasabi.
But why would they need to decrypt Wasabi's mixing algorithm? Well, behind that mixing, there was some information about the DAO hacker. Yes, the one who stole around 3.64M ETH in 2016.
But before we talk more about the case, the million-dollar question is still up in the air. Why did Chainalys start to decrypt a wallet considered anonymous and undetectable?
Well, it all starts with one woman: Laura Shin.
Shin is a former senior editor at Forbes and had been working on her book, "The Cryptopians: Idealism, Greed, Lies, and the Making of the First Big Cryptocurrency Craze when these revelations came to light. As the story goes, one of the sources for her manuscript shared some information that changed the course of her investigation.
She found out that the Wasabi wallets did not use the well-known Zerolink protocol. They used a riskier technique called "peelchain." As the name may reveal, transactions are progressively "peeled."
Shin got in touch with Chainalysis, a blockchain analytics company, upon learning this. Chainalysis found a way to interpret how bitcoins were mixed in Wasabi.
According to Shin, this minor flaw allowed Chainalysis to identify some of the hacker's transactions. And not only his transaction but his identity too.
They discovered that the hacker sent the mixed BTC to four exchanges.
Shin has been following the case for quite some time. Her report states the attacker moved funds to a new wallet that remained dormant until late October. Then, he used an exchange called ShapeShift to swap the money for bitcoin.
ShapeShift at the time took no personally identifiable information. That allowed the hacker to remain hidden even if all the traces were visible in the blockchain.
Over the next two months, the hacker obtained 282 bitcoins. Back in 2016, that was worth around $232K. Now, those BTC are worth over $11M.
Yet, something happened. ShapeShift identified that the funds came from that hack and started to block The DAO hacker's attempts. He then stopped trying to exchange the stolen ETH for BTC.
Shin had been working for quite some time in the industry, which allowed her to gather great sources. One of those sources worked in one of the exchanges The DAO hacker used.
They found out he exchanged BTC for GRIN, a privacy coin. Later, the hacker sent these coins to an actual GRIN node that kept the network up and running.
Yet, the node had a readable URL: grin.toby.ai. Toby.ai was the alias The DAO hacker used. Chainalysis started to dig deeper and find the IP address the node was hosted on. They found several lighting nodes —one of the nodes was called TenX.
A little Google search for TenX and up pops a project by that name. Its founder and CEO is Toby Hoenisch, who used the handle @TobyAI on various social networks.
Toby Hoenisch is an Austrian man now in his mid-30s. He deleted almost all his social media presence. Yet, there are reports of him trying to alert The DAO devs of some code vulnerability. Yet, back then, the developers didn't believe that matter to be a priority.
Is Toby Hoenisch The DAO hacker? Shin believes he is. Hoenisch, however, denies being the hacker. When Shin reached out to him, he told her that what she said was factually inaccurate.
He told her he could provide more details, yet he disappeared again without sharing any extra material.
What Shin and Chainalysis found is remarkable, but only you can judge whether Hoenisch is the DAO Hacker or not. What does your judgment say?