After a developer leaked private keys to GitHub, someone used them to drain $375,000 from the unshETH defi project. The project emergency paused withdrawals of unshETH ether to prevent further damage.
The leaked key allowed the attacker to transfer ownership of project smart contracts to themselves, though they later returned ownership.
unshETH posted a message to the hacker, demanding they return 90% of the stolen funds. They threatened: “We want to be clear, and this is not a bluff: we know who you and some people connected to you (friends) are, and we will absolutely move forward with law enforcement if you have not returned the money by the deadline above. We don’t want to do this to you or have to rope your friends in, and would prefer everything be settled and everyone just move forward, but if we don’t get the funds back by the above-mentioned time, we will be left with no choice in order to protect our protocol.”
“Sounds exactly like someone bluffing would say”, wrote one commenter.
