What happened
On October 26, 2020, EtherCrash, an Ethereum crash-gambling site built on the Bustabit model, lost 6,378 ETH (about $2.5 million at the time). EtherCrash told users on Discord that its cold wallet had been compromised and two large withdrawals made. On-chain, wallet 0x7F8e61f666043439572b1E2135aeE18b27c0662D sent 6,330 ETH and then 48 ETH to 0x11CF6c527C22F99c51Fab46459924AAFD96e21F9 within about 45 minutes.
The same day the receiving address deposited 500 ETH into Tornado Cash in 100 ETH lots and swapped most of the rest, including a 5,800 ETH trade, on Uniswap. Investors in the site's bankroll bore the loss. EtherCrash said it would compensate them without taking commission but that repayment would take time; no completed repayment was found.
EtherCrash has not published how the wallet key was obtained.
How it happened
- At 07:32 UTC on October 26, 2020, EtherCrash's wallet
0x7F8e61f666043439572b1E2135aeE18b27c0662Dsent 6,330 ETH to0x11CF6c527C22F99c51Fab46459924AAFD96e21F9, followed by 48 ETH at 08:16 UTC. Signing these transfers required control of the wallet's key. - The receiving address deposited five lots of 100 ETH into Tornado Cash that day.
- It swapped the bulk of the remaining ETH, including a 5,800 ETH trade, on Uniswap; secondary reports say the proceeds went into DAI.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
