Researcher: The Multichain attacker is likely not a hacker, and the operator may not have absolute decision-making power

ChainCatcher news, researcher from New Fire Technology and researcher from China's national think tank 0xLoki speculated on Twitter: "It seems like the complete control was lost due to some irresistible force, rather than simply being attacked."

The abnormal fund flow in Multichain has the following four characteristics: 1. The duration of asset transfer is very long, indicating that the transferor is not in a hurry; 2. A small test of 2 USDC was conducted before the asset transfer, indicating that the transferor has sustainable transfer capability; 3. Each type of asset was transferred to an independent wallet, with no further actions (such as transferring to an exchange, swapping, or mixing coins); 4. The receiving wallet is completely clean, with no gas fees even.

Information inferred from the characteristics: 1. The transferor has ample time, considering the technical characteristics of MPC, the transferor likely gained complete control over the threshold private key shares in some way; 2. The 'attack method' is very simple, just a pure transfer operation, with no contracts, and there was testing, so the attacker is likely not a hacker; 3. The transferor did not take further actions or liquidate, indicating that the operator may not have absolute decision-making power."

0xLoki believes that the assets controlled by Multichain MPC multi-signature are no longer under control. Correspondingly, if the holders of the controlled shares hold other MPC or multi-signature shares exceeding the threshold, all these assets and contracts may also be out of control. Therefore, it is necessary to immediately check all risk exposures related to Multichain contracts/cross-chain assets, and next, attention can be paid to what the receiving address will do. In addition, 0xLoki also stated that there is no problem with MPC, but it is problematic for a natural person to hold shares exceeding the threshold and to be in a jurisdiction where cryptocurrency activities are prohibited or unprotected. (Source link)