WazirX hackers may have used a purchased Binance Know Your Customer (KYC) account to funnel 9.19 ETH into a compromised wallet. This highlights a troubling trend of cybercriminals exploiting verified identities to evade detection on major cryptocurrency exchanges. KYC is a process used by crypto and other exchanges to verify users’ identities.
According to cryptocurrency researcher Aditya Singh (@CryptooAdy), the wallet in question received 9.19 ETH from the Binance KYC and an additional 3.8 ETH from another active wallet.
While these findings suggest the hacker may have used a legitimate Binance account to fund their activities, the investigator posited that the hacker might have purchased a pre-verified KYC account, a tactic commonly employed by cybercriminals to bypass identity verification and avoid detection.
“Since these funds came from a Binance KYC account, it is worth checking unless the hacker used bought KYC account to fund the Wallet,” Aditya Singh tweeted.
This method of obtaining and using KYC-verified accounts allows hackers to exploit exchanges and mask their real identities. In this case, the hacker appears to have employed similar tactics on WazirX, allegedly using bought KYC accounts to conduct transfers and launder funds through the platform.
The ease with which hackers can purchase such accounts raises questions about the robustness of identity verification measures on major exchanges like Binance.
Blockchain transactions are transparent, as users can track assets’ movement. However, cyber security experts find it hard to investigate crypto-related crimes as there is no differentiation between honest and malicious users moving stolen crypto assets by purchasing IDs.
Though bounty hunters and security teams are likely aware of the common practice of buying KYC accounts, the investigator emphasised the need to investigate this case in detail to prevent similar hacks.
The open visibility of these transactions on the blockchain clearly shows that vigilant monitoring and improved security protocols are essential in curbing these cybercriminal attacks.
After suffering a major data breach in July, WazirX has filed a moratorium in the High Court of Singapore on the proposed restructuring process. Meanwhile, hackers are moving millions through Tornado Cash.
In the News: CCI accuses Amazon and Flipkart of antitrust violations
