The attacker seems to be trying to use BINANCE and Change now to withdraw money.
The damages incurred
According to research by blockchain analytics (1) vendor OKLink, the Bitkeep hack that happened on December 26 employed phishing websites to trick users into installing false wallets. According to the study, the attacker created several fictitious Bitkeep websites that each hosted an APK file that seemed to be Bitkeep wallet version 7.2.9. Users' private keys or seed words were taken when they "updated" their wallets by downloading the malicious file, and they were delivered to the attacker.
?12-26 #BitKeep Hack Event Summary?
1/n
According to OKLink data, the bitkeep theft involved 4 chains BSC, ETH, TRX, Polygon, OKLink included 50 hacker addresses and total Txns volume reached $31M.
— OKLink (@OKLink) December 26, 2022
The malicious software grabbed the users' keys in an unencrypted form, although the report did not specify how. It may have just asked the users. as part of the "upgrade," to re-enter their seed words, which the program may have logged and forwarded to the attacker. After obtaining users' private keys, the attacker unstacked all assets and transferred all funds to five wallets under their command. From there, they attempted to withdraw part of the money via centralized exchanges: two Ethereum (ETH) and one hundred dollars (USDC) were sent to Binance, and twenty-one ETH was sent to change now.
Will similar incidents occur?
The attack affected five networks BNB Chain, Tron, Ethereum, Polygon, and BNB Chain bridges. Some coins were connected to Ethereum via the bridges Biswap, Nomiswap, and Apeswap. The hack resulted in the theft of over $13 million cryptocurrency.
Why did my Bitkeep wallet automatically transfer 0.05BNB at 04:00 on December 26th when I slept the most soundly? pic.twitter.com/B0jL2mwHFe
— Far away (@Hk0954859Kim) December 26, 2022
It is yet unclear how the assailant persuaded visitors to the phony websites. The official Google Play Store page for BitKeeper has a link that directs people there but does not include an APK file for the program. Peck Shield alerted authorities to the BitKeeper assault around 7:30 AM UTC. It was attributed to an "APK version hack" at the time. According to this latest report from OKLink, the developer's official website was not compromised, and the stolen APK originated from rogue websites.
