Impossible Finance Hack

The attacker's address:

Address 0x8e0d…ef02

The transactions behind the attack:

Contract calls

The attacker:

• Borrowed 233.3 BNB of flash loan from PancakeSwap
• Swapped 65,140 IF tokens
• Created a fake token called AAA (BBB)

Token

• Created LP with the fake token and IF token
• Swapped 32,570 IF into 221,898 BUSD and another 32,570 IF into 221,898 BUSD using IF router through the FAKE token LP
• Repeated the steps from 3 to 5
• Sold 556,384 BUSD for 1,731 BNB, repaid the flash loan.

Stolen funds were bridged into Ethereum mainnet onto this address:

Address 0x8e0d…ef02

The further destination is unknown.

There are transactions where the Impossible Finance hacker is transferring BNB tokens, which were used to perform a flash loan into the Impossible Finance deployer's address at:

Tx 0x05d9…b244

Tx 0x4874…dbb1

In addition:

• Impossible Finance exploiter into 0x6b3 (849.2 BNB):

Tx 0x7104…5eff

• 0x6b3 into Eleven Finance deployer (849 BNB):

Tx 0xb70c…e4f1

The further funds' flow as follows:

1. Deployer into Gnosis Safe Proxy:

Tx 0x48cc…e644

Tx 0x1384…45ec

2. Gnosis Safe Proxy into 0x22b (1,000 BNB):

Tx 0xfdb6…6c96

2.1 Gnosis Safe Proxy into 0x1Cc (521 BNB):

Tx 0x63d7…2e80 (Still on the balance)

3. 0x22b into 0x736 (900 BNB):

Tx 0xdb88…4941

3.1 0x736 into Disperse (674.35 BNB):

Tx 0xf912…c010

Tx 0xe705…7776

3.2 0x736 added liquidity into pair WBNB / IF (225 BNB):

Tx 0xedcd…8833

Tx 0x3c8d…772c

Tx 0xb938…4f57

4. 0x22b into 0x1Cc (451 BNB):

Tx 0xc248…e5fd

Tx 0xf984…98c0

4.1 0x1Cc into Binance How wallet (450.99 BNB):

Tx 0xf3ce…ebc3