Safemoon - final

In the last post, we said that funds in the total amount of 21904 BNB from the hacker's address 0x237d58596f72c752a6565858589348d0fce622ed were withdrawn to the address 0xc6a84899ea428cf69a0f61d5d8f32b2bcb63962f.

Next, we will talk about further movements of these funds.

I. From the address 0xc6a84899ea428cf69a0f61d5d8f32b2bcb63962f by the transaction with hash ID 0x9449a95949690bff0fdd0c17b4ef6a0cd5a8425f6bfb697789f89f95538f629f funds in the amount of 21904 BNB were sent to the address 0xdaa3b5ae0521264e55f45157eb6e158e1f3e5012, from which interesting movements have taken place:

1). Funds in total amount 6783 BNB were sent through the swap procedure back to the Safemoon liquidity pool (0x8e0301e3bde2397449fef72703e71284d0d149f1) in the form of wrapped tokens 6783 WBNB by the transactions with hash IDs:

0x1e55130fc96d170f0ed257c2df0a52e8a57a6d881b55bf965ea6a80bebfae941

0x01aebb5013e044d14651075f3f5f0bea24cae272ff067b2e148f2c8b498c88a4

2). Through the swap procedure funds in total amount 2484200 USDT and 1208.83 ETH were sent to the deposit address of ?Gate.io? cryptocurrency exchange 0xa17f43a2bd31227f893a7868a1b6e22d02112604 by the transactions with hash IDs:

0x77db077ce7b42819189602008e24d028dce05c10988bf41d9bc3d34a8cfe65b6

0xd7cc1e48763285aed171bdfa6ef82ce763ee71e51027401f80e4e18cfcb79364

0x5515d7be4b28ab4b506acc03e4b351aaf7ca983a70374819749ed8e75a8497c0

II. Also on April 28, 2023 there were new withdrawals of funds from the hacker's address 0x237d58596f72c752a6565858589348d0fce622ed (our ?Blue meerkat? where were the previously stolen funds in the amount of 27380 BNB):

1). From the hacker's address 0x237d58596f72c752a6565858589348d0fce622ed funds in the total amount of 5476 BNB were sent to the address 0x0d5c28f489229b5a58be8208142d9199ea1250c6 by the transactions with hash IDs:

0x20db1f47c090d37f5390887fe43a24f8a011042f48c0e18c7a6d659e6ee7488f

0x2ddd153c94e752e219819d3b40c2adcbde94ee628b56c5c713db09c25618be8a

0x9fcec3916e47cec71d1e7cfc00adb9fc5641e93ca63e5c5fa54d5218f4c250c8

2). From the address 0x0d5c28f489229b5a58be8208142d9199ea1250c6 funds in the total amount 5476?BNB were sent to the address 0x9c48dbaede745d02b32632127a7c281920ee6055 by the transactions with hash IDs:

0x2a1624816bda279599a2629546707209e2d06ee2c4a77fa4c5d589dbd71ae88c

0x4800e385dd3fff75b91e19796b27faefe15a00f7ea021720152519c30e49b215

3). From the address 0x9c48dbaede745d02b32632127a7c281920ee6055 funds in the total amount 2003 BNB were sent to the address 0x73c5e6f1573ce8ceac6fb83bf0fec162a77df24e by the transactions with hash IDs:

0x03a101038d1c62ef625359a2037d6b812ca3d020c468707a50569d2d880a9f5a

0x622be4e18f14e55eec94d1cf847cc2a6abaf15b1b58d5b4bd56cc7b303d87dd3

0x0e87e7a59183498d225d3d9ac2f9d68332f4bd8cb0857fbef8207271c9a71dfc

The remaining funds in the amount 3473 BNB continue to be at the address?0x9c48dbaede745d02b32632127a7c281920ee6055.

4). From the address 0x73c5e6f1573ce8ceac6fb83bf0fec162a77df24e funds in the amount 307 BNB were sent to the deposit address of ?OKX? cryptocurrency exchange 0xfd33b0fba8f013d1829ed648c13f8b14f0f2a03f by the transaction with hash ID:

0x75de80214cbb9a44d632576e6db2aba3b56c1adc7fe43616d43621169ef70153

From the address 0x73c5e6f1573ce8ceac6fb83bf0fec162a77df24e funds in the amount 700 BNB were sent to the deposit address of ?OKX? cryptocurrency exchange 0x822655709ecc43ea60b8165b0b4116f425740cc0 by the transaction with hash ID:

0xcd680764f45f522855568b802216718a6ee0a540a8bd4151fbe0314b5fdc4ab5.

Interestingly, the indicated deposit addresses of the OKX exchange were also replenished with BNB tokens from two addresses with a small volume of transactions 0xf6178d7b9ccf703fa808c4a4c9c290d968dfb335, 0x82383c6f17cf7072ded2660b9a6622cb41296ba3, for which funds in BNB tokens were received by more than 99% from the Binance exchange. Examples of transactions from the Binance exchange:

0x46d7decebb547dee1986fab115121a68ac693ffe29d5dbe9eb845535b82b5855

0xe5f38ee43576ae79787acb032aa5fdec6fd61fd6d0b46e8a4207c6038e6cdd0c

0x043644c067eae1374e625ab4eb83d106516c2f979574563b1dc8b07ff77c3ff6

0x992f89d024d28ba1f464fd4045fae3a3939e799f958dd6f7c56effd2beeb044c

This information gives even more opportunities for deanonymization of the hacker.