A Telegram bot allowing to get stolen cryptocurrencies at a discount has been discovered online

Blockchain researchers have uncovered a person involved in the sale of stolen tokens at discounted prices. Representatives of Match Systems managed to identify the person who offered the stolen assets via Telegram and establish contact with him.

Experts confirmed that the user controlled an address containing cryptocurrency worth more than $ 6 million. The stolen assets were sold through a specially created Telegram bot that offered a 3% discount on the market price of the token. As the fraudster told the researchers, the initial assets he offered have been sold, and new tokens will be available in about three weeks:

«While maintaining our contact, this person informed us that they have started selling new assets. Based on the available information, it is logical to assume that these are funds from CoinEx or Stake,» Match Systems said.

Security experts were unable to fully identify the fraudster, but narrowed his location to the European time zone based on several screenshots and the timing of the conversations: «We believe that he is not part of the core team, but is associated with them, possibly de-anonymized as a guarantee that he will not abuse the delegated assets.»

It also became known that the individual demonstrated erratic and volatile behavior during various interactions with Match Systems, suddenly ending the conversation with the words: «Excuse me, I have to go, my mom is calling me for dinner.»

As a reminder, blockchain security firm CertiK previously described the movement of stolen funds during the Stake heist. About $ 4.8 million of the total $ 41 million was laundered through various token movements and cross-chain swaps. Later, the US Federal Bureau of Investigation named North Korean hackers Lazarus Group as the culprits behind the Stake attack, and cybersecurity firm SlowMist also linked the $ 55 million hack of CoinEx to the North Korean group.