US Government $20M Theft

$20M in assets including USDT, USDC, aUSDC and ETH have been transferred from a US Government controlled address (0xc9E) to an unlabelled address (0x348), after their withdrawal from lending platform, Aave. The attacker has since converted majority of the stablecoins for ETH to prevent Circle and Tether from freezing the stolen proceeds. The ETH tokens were subsequently transferred across a handful of addresses including six Binance deposit addresses and one unlabelled address (0x1bA), which could be cryptocurrency mixing service, which are commonly utilized for money laundering purposes. The attacker’s address still holds $13.26M in aUSDC, an Aave-based interest-bearing token.

The immediate conversion of stablecoins to Ethereum highlights the technical censorship risks associated with centralized tokens. Issuers like Tether and Circle possess the ability to interact with their token smart contracts to blacklist specific addresses and freeze assets instantly. By swapping into ETH—a decentralized, censorship-resistant asset—the entity ensures the funds cannot be remotely locked by a central administrator, complicating recovery efforts.

Furthermore, the fact that these government-controlled assets were withdrawn from Aave suggests they were being actively utilized in Decentralized Finance (DeFi) rather than sitting in idle custody. Typically, seized assets are held in secure, offline "cold storage" to mitigate risk. The presence of these funds in a lending protocol exposes them to smart contract vulnerabilities and indicates a deviation from standard asset management procedures for confiscated funds.

The funds held by the US Government address originate from the infamous 2016 Bitfinex hack, in which 119.76K BTC, worth $72M at the time, were siphoned from the centralized exchange, Bitfinex. The accused perpetrators, Ilya Lichtenstein and his wife, Heather R. Morgan, were arrested in February 2022 for the crime, leading to the seizure of the funds and are due for sentencing in November.