HYDERABAD: Cyberfraudsters hacked a company’s crypto wallet and stole utility tokens worth Rs 37.57 lakh and sold them.
The complainant’s company is incorporated in the British Virgin Islands and its representative, a resident of Gachibowli, said the firm operates in the technology sector. As part of its business, the company has issued utility tokens, digital assets in the marketplace that grant holders access to specific products, platforms or services offered by the firm and these were issued lawfully in compliance with the laws of the British Virgin Islands, which permit technology companies to issue such digital instruments as part of their operations.
The complainant said that the tokens hold real monetary value because people buy and sell them on digital trading platforms, called exchanges. Therefore, the theft of tokens has caused substantial financial harm to the company.
The complainant said that as an authorised individual of the company, he had lawful access to the company’s cryptocurrency wallet and private keys from Hyderabad when they were compromised in this incident.
On April 10, the company’s cryptocurrency wallet operating on the Base Network was compromised via a wallet drain exploit. An unauthorised third party (the hacker) drained 447.586 tokens and transferred them to another wallet.
Following the theft, the hacker attempted to liquidate all approximately 447,586 tokens, but only approximately 110,936 tokens were successfully sold for approximately 9,245 USDC. The remaining approximately 336,650 tokens were subsequently routed through a chain of wallets in what appears to be deliberate layering to obscure the trail of stolen funds.
Till Thursday, approximately 335,950 tokens (valued at approximately USD 26,450) are ready to be sold by the hacker on a cryptocurrency exchange platform. Upon being notified of the theft and the inflow of stolen funds, the exchange platform temporarily froze the relevant account(s) for a period of seven days. The platform told the company that in order to extend this freeze and take permanent enforcement action, a formal law enforcement request must be submitted by a competent judicial or police authority.
Following this, the representative of the company filed a complaint with Cyberabad Cybercrime who registered a case. Further investigation is on.