Nexus Mutual Hacker Now Demands $2.8 Million (4,500 ETH) Ransom

The attacker that drained over $8 million in NXM from the founder of Nexus Mutual had requested $2.8 million in ETH to stop disposing of the funds. As such, it seems that he has rejected the bounty offer from Hugh Karp of $300,000.

What Happened With The Funds Of The Hack?

CryptoPotato reported earlier this week that an unknown perpetrator drained over $8 million worth of the NXM token from Hugh Karp – the founder of the popular DeFi insurance provider – Nexus Mutual.

The attacker duped Karp by reportedly gaining remote access to his computer and modifying the MetaMask extension. Thus, he managed to trick Karp into signing a different transaction that transferred all funds to the hacker’s address.

The victim classified the attack as “a nice trick” and offered a bounty of $300,000 if the perpetrator returned all NXM.

However, it seems that the attacker has refused Karp’s offer. The blockchain analytics company Scorechain traced the stolen funds that were first turned into wrapped NXM (wNXM) before transferred into wrapped Ethereum, wrapped Bitcoin, and ultimately – BTC.

The company concluded that the hacker has cashed out about half of the funds and has 147 BTC. However, Scorechain also said that the hacker had to go through a know-your-customer (KYC) process when transferring the funds, meaning that his identity should be registered on some of the platforms.

Nexus Mutual’s Hacker Demands ETH

Another sign that the attacker has rejected the bounty came earlier today. He sent a transaction to a known ETH address of Karp requesting 4,500 ETH tokens to stop selling the stolen and converted wNXM. With ETH’s price shooting to $620 as of writing these lines, this amount equals $2.8 million.

“Hello Hugh. I will not sell wNXM any more until wNXM recovers his value or you send me 4.5k ETH.If you need any negotiation with me, send msg to my eth address.Following are your addresses. You are rich, Hugh.0x87B2a7559d85f4…”
– 0x07840..482https://t.co/PwH8yIk7aL

— EtherText (@EtherText) December 16, 2020

However, Karp explained on his Twitter account that the address provided by the attacker actually belong to the Nexus Foundation. Additionally, he noted that he doesn’t have that much ETH.

It’s worth noting that NXM dropped by nearly 30% following the attack. The attacker has apparently acknowledged this decrease, saying that he will not sell more tokens until the asset recovers its value.