Related Addresses
Attacker1 Addresses
0xc7aea2641aeef2a6ab0eae59052c9cc79a0e0163
0xc8584fb004c02f8102385632cca665f35071a8de
0x0f152e2d1a5f006da5cd2f8f88edf232fb825d21
0x235adeb3b06134f5308ea58c68387937ea4bf7c9
0xfe7101d155eb11640e5a4bf342cd066dce51e9e3
0xc06375093147d626676568475a341ba48f058cf0
0x1f17a1fe465237c4ffd783b6852cfc479cb885a0
0x417ac45efd7dec7e2ffb16018fe6a30f639f5a15
0x3bca817c47e0ded79fed1eab1f1acbf42f0be83d
0xd39238c8b070cb226a30fd89f2c61735658bf2e2
0x2e7db877d269e715c78d2edbadc77837b7b44d6d
0x779844b7f12ffe9f8680271807b8d64cefb3f9d9
0x18238940373687f34acc2fc93b4bb50b3d4a8b4a
0xfc74715f03762d41ba57afa1feabcdc8d59946ad
0xcd8b90d4a3ef8d1bb8db736ebb3a08038cfbfc14
Attacker2 Addresses
0x0f06407e2dab5701374db1e7c1320f9cb69cadae
0xbab6183c639ccbec4b422fdb622310264e3f6468
0x4a33d3880ee5ec4e990b6c31e041632279471d70
0x78cc1b466d32d17fa79af3dbd1cb7fbe980ff6c9
0x2bf125679008fb09cb284338848f65fd578943bb
0xe1c15d4e966160e29c3e45e47772571a923b372b
0x96e51ce5a04bad5918982f37fa21be96976d9a3b
0x587b7ec41db6666bf304c468b10bf2342545c3cf
0x7c655ab077c09fdd357230e0c73d044a4dce87f7
Attacker3 Addresses
0x958bc7f87992791e89a5cfe764ff5541f6329642
0xeae87f647d6363ea131da8e422db2f0dbed056e0
0x31fa3341157f3a159a860ae102bc39b62e634577
0xc855b0f05745d097184a426d1e991ad3c9142757
0xad1aabb563a5975abab26d70f7dbeccd7a18498d
Attacker4 Addresses
0x8fc15971e43588f2d9936be8cad323f0ac023126
0x8e4932d3a78832c2ae46c7c9b655da92a435a230
0x2ad19a56290a6b027031b81a9316183f1aa2f25e
0x08a9626db08e83d2afec24523b727f50e362e4b8
0x8aff98165744a616d269ac5f21b3fb1a602e727f
Attacker5 Addresses
0xbf5a35af3881ed0d3e8d22d497daa01278f4b3ab
0xd9f0ba434aec22236820eef6147e5f6e721fe673
0x0f67dcb8c6a700134ed53de66ef9c0aaf6fa3a1a
0x81ec992a20b214e0c514ae22f5b0275f8bd6eef8
0xf172629b863be0b7b512f7182bd84420ca92d0b2
0xfd983a09ce9aa89375d59b3b1f8dc787aba1e4dc
0x104f0ac8bc5d66442d9afa5ab058f6739ba216f2
0xef7188a044083b0855a90f4e0ce0146e9a69e924
0x42ce40ff5318ae96dfd06f62009e466dc531d2ad
0x66184b144b01427235c157ab328c5b0cce2e2510
0xf3228d12156531f20fc240d2d6e9859cd106218d
0xaa73a767ddb2147041ff87497a0f4fc8fdabb80a
0x2aa97744bb2564431fb3aa9c09fa0619fafaccdf
0x1172cf0fd3e95507776cba293882de7276fcc7ad
0xff75d156cc4f3497199f5639ed4a8f47aa001947
0x39f9bd11f1f9042ae55eeca31dfd1ff8cc008cf4
0x80f65e34adc9fb29a9eed1e99ea7d050202d7ff1
0x27ee3cde011352cdd5132a6e7265a1bb315f0261
Attacker6 Addresses
0x76be491293ecd94651d90b02d2ffa66c96be273e
0x23cf62b21994d697eb2736fb96932a616f9cf7b6
0x49c847bf20ff522369fc1138f2e84a14a7c4eedc
0x09f8e17536c533175616cce6b8d48840152b243e
0xead63480ce6febefee29cd1d065bea18ca3e155b
0x0d7b2264016d770e5bd619d57f049accd61f9ddd
0x30f268c2ff4bdd93991e8185da5d32e4b6ecbdcc
0x1257aecc7d12de3ad1cdb66e232c41781e9f780d
0x0f550e11baba9365a936ac279d9a2ad72c908bc9
0x378bde8b897d64f4047189c3f8b689008a560bad
0xa1164d99e55c371f513a398843bf82cd81f23804
0x7da17cd5d9dae4e26eacb2a2fe031826864adb5a
0x352efd95031872b60409e71e29294a6f58872893
0xca81ceb154aeb1f7673c3070e2c60616536f8eaf
0xfab41886675181a3f79700991f644b5052fed009
0xa69fc13ed5265b4cc842240990dfe38a8afe8536
Attacker7 Addresses
0xc156f7a024478891316e32fdd95c8f3905f73515
0xbc4097fee46bef28dbc766b9c8f6070b9bcef6b1
0xef2a103746cce48a30921355e05b29ec2d554a07
0x0966d26521c18e82d11c40d64d3d1853ced5e707
0xebceb5c380e305fc9f061e35ca2b71309b17e6b1
0xf4abdff96176b4102dfe613c121f93b76cd77ba1
0x64959312c01930b8776a81e7775298533630ca12
0x79ad3b97d3527572dc82f3774f412eb76c85a084
Attacker8 Addresses
0xc0d3a8d939d8653f0fd8fe7a0646dd3884293466
0x97cd05ee9f47c6aba029c5ed4fbce8ce817586e3
0xd201ecbe85a32944464964a1e1c02f923e7c4dfe
0x0c430e78c46e9d60c1de628cdcccfa1cf6a20478
0xf42b7a30cca2627b26e3167cff1d9282213c5a04
0x046d05c025aa76452bafc566ff69ef65c06973df
0xeba1891a6228ba59e09e5118a76abde35fcbc8b6
Attacker 1
Chain: Arbitrum, Reason: Bridging with multiple wallets
0xc7aea2641aeef2a6ab0eae59052c9cc79a0e0163
main wallet sending 0.2 ETH to each sub wallets:
0xc8584fb004c02f8102385632cca665f35071a8de 0x0f152e2d1a5f006da5cd2f8f88edf232fb825d21 0x235adeb3b06134f5308ea58c68387937ea4bf7c9 0xfe7101d155eb11640e5a4bf342cd066dce51e9e3 0xc06375093147d626676568475a341ba48f058cf0 0x1f17a1fe465237c4ffd783b6852cfc479cb885a0 0x417ac45efd7dec7e2ffb16018fe6a30f639f5a15 0x3bca817c47e0ded79fed1eab1f1acbf42f0be83d 0xd39238c8b070cb226a30fd89f2c61735658bf2e2 0x2e7db877d269e715c78d2edbadc77837b7b44d6d 0x779844b7f12ffe9f8680271807b8d64cefb3f9d9 0x18238940373687f34acc2fc93b4bb50b3d4a8b4a 0xfc74715f03762d41ba57afa1feabcdc8d59946ad 0xcd8b90d4a3ef8d1bb8db736ebb3a08038cfbfc14
Attacker 2
Chain: Arbitrum, Reason: Same transactions in Arbitrum and sending ethereum to the next wallet in Ethereum Chain.
Ethereum Side:
0x0f06407e2dab5701374db1e7c1320f9cb69cadae
sending '0.98 ETH' to:
0xbab6183c639ccbec4b422fdb622310264e3f6468
sending '0.974 ETH' to:
0x4a33d3880ee5ec4e990b6c31e041632279471d70
sending '0.966 ETH' to:
0x78cc1b466d32d17fa79af3dbd1cb7fbe980ff6c9
sending '0.958 ETH' to:
0x2bf125679008fb09cb284338848f65fd578943bb
sending '0.951 ETH' to:
0xe1c15d4e966160e29c3e45e47772571a923b372b
sending '0.944 ETH' to:
0x96e51ce5a04bad5918982f37fa21be96976d9a3b
sending '0.937 ETH' to:
0x587b7ec41db6666bf304c468b10bf2342545c3cf
sending '0.929 ETH' to:
0x7c655ab077c09fdd357230e0c73d044a4dce87f7
Arbitrum Side:
All of this wallets have same transactions.
All transaction was 197 days ago.
Attacker 3
Chain: Arbitrum, Reason: Same transactions and finally sending money to same wallet
Main wallet:
0x958bc7f87992791e89a5cfe764ff5541f6329642
Subwallets :
0xeae87f647d6363ea131da8e422db2f0dbed056e0 0x31fa3341157f3a159a860ae102bc39b62e634577 0xc855b0f05745d097184a426d1e991ad3c9142757 0xad1aabb563a5975abab26d70f7dbeccd7a18498d
Attacker 4
Chain: Optimism but transactions connected in Ethereum, Reason: Each wallet sends eth to next wallet and bridging
0x8fc15971e43588f2d9936be8cad323f0ac023126
(anybody4u.eth) sending 1.22 ether to
0x8e4932d3a78832c2ae46c7c9b655da92a435a230
and '0x8e4' sending 1.165 ether to
0x2ad19a56290a6b027031b81a9316183f1aa2f25e
and '0x2ad' sending 1.12 ether to
0x08a9626db08e83d2afec24523b727f50e362e4b8
and '0x08a' sending 1.066 ether to
0x8aff98165744a616d269ac5f21b3fb1a602e727f
All of this transactions was done 177 days ago and this wallets bridging Ethereum to Optimism, and in Optimism chain they are making sybil attacking..
Attacker 5
Chain: Polygon, Reason: Making same actions and finally sending money to same wallet.
All of this wallets making same action
(matic to ethereum swap and bridging them and finally sending money to 0xbf5a35af3881ed0d3e8d22d497daa01278f4b3ab
:
0xd9f0ba434aec22236820eef6147e5f6e721fe673 0x0f67dcb8c6a700134ed53de66ef9c0aaf6fa3a1a 0x81ec992a20b214e0c514ae22f5b0275f8bd6eef8 0xf172629b863be0b7b512f7182bd84420ca92d0b2 0xfd983a09ce9aa89375d59b3b1f8dc787aba1e4dc 0x104f0ac8bc5d66442d9afa5ab058f6739ba216f2 0xef7188a044083b0855a90f4e0ce0146e9a69e924 0x42ce40ff5318ae96dfd06f62009e466dc531d2ad 0x66184b144b01427235c157ab328c5b0cce2e2510 0xf3228d12156531f20fc240d2d6e9859cd106218d 0xaa73a767ddb2147041ff87497a0f4fc8fdabb80a 0x2aa97744bb2564431fb3aa9c09fa0619fafaccdf 0x1172cf0fd3e95507776cba293882de7276fcc7ad 0xff75d156cc4f3497199f5639ed4a8f47aa001947 0x39f9bd11f1f9042ae55eeca31dfd1ff8cc008cf4 0x80f65e34adc9fb29a9eed1e99ea7d050202d7ff1 0x27ee3cde011352cdd5132a6e7265a1bb315f0261
Attacker 6
Chain: Arbitrum & Optimism, Reason: All of this wallets have same actions and they are connected both in optimism and arbitrum. Sending funds to next wallet and bridging in Optimism.
0x76be491293ecd94651d90b02d2ffa66c96be273e 0x23cf62b21994d697eb2736fb96932a616f9cf7b6 0x49c847bf20ff522369fc1138f2e84a14a7c4eedc 0x09f8e17536c533175616cce6b8d48840152b243e 0xead63480ce6febefee29cd1d065bea18ca3e155b 0x0d7b2264016d770e5bd619d57f049accd61f9ddd 0x30f268c2ff4bdd93991e8185da5d32e4b6ecbdcc 0x1257aecc7d12de3ad1cdb66e232c41781e9f780d 0x0f550e11baba9365a936ac279d9a2ad72c908bc9 0x378bde8b897d64f4047189c3f8b689008a560bad 0xa1164d99e55c371f513a398843bf82cd81f23804 0x7da17cd5d9dae4e26eacb2a2fe031826864adb5a 0x352efd95031872b60409e71e29294a6f58872893 0xca81ceb154aeb1f7673c3070e2c60616536f8eaf 0xfab41886675181a3f79700991f644b5052fed009 0xa69fc13ed5265b4cc842240990dfe38a8afe8536
Attacker 7
Chain: Ethereum & Polygon Chain, Reason: Bridging with multiple wallets at different times.
Ethereum Side:
Main 1 :
0xc156f7a024478891316e32fdd95c8f3905f73515
funding this wallets in different times :
0xbc4097fee46bef28dbc766b9c8f6070b9bcef6b1 0xef2a103746cce48a30921355e05b29ec2d554a07
Main 2 :
0x0966d26521c18e82d11c40d64d3d1853ced5e707
(ashodler.eth) funding this wallets in different times :
0xebceb5c380e305fc9f061e35ca2b71309b17e6b1 0xf4abdff96176b4102dfe613c121f93b76cd77ba1 0x64959312c01930b8776a81e7775298533630ca12
'0x649' + '0xf4a' funding this wallet :
0x79ad3b97d3527572dc82f3774f412eb76c85a084
Polygon Side:
All of them except '0x0966' and '0xebceb' bridging in Polygon Chain. '0x0966' and '0xebceb' bridging in Ethereum Chain.All of this wallets connected with each other.
Attacker 8
Chain: Arbitrum, Reason: Each wallet sends eth to next wallet and bridging :
0xc0d3a8d939d8653f0fd8fe7a0646dd3884293466
sending '0.5 ETH' to :
0x97cd05ee9f47c6aba029c5ed4fbce8ce817586e3
sending '1.35 ETH' to :
0xd201ecbe85a32944464964a1e1c02f923e7c4dfe
sending '0.01 ETH' to :
0x0c430e78c46e9d60c1de628cdcccfa1cf6a20478
sending '0.1 ETH' to :
0xf42b7a30cca2627b26e3167cff1d9282213c5a04
sending '0.012 ETH' to :
0x046d05c025aa76452bafc566ff69ef65c06973df
sending '0.434 ETH' to :
0xeba1891a6228ba59e09e5118a76abde35fcbc8b6
All of this transactions 202-217 days ago. And some of the wallets using DAI for bridge, some of the wallets using ETH.
Reasoning
The transaction times and amounts sent by the wallets to the bridge contract are close or equal and many wallets connected with each other.
For example wallet x sent 0.29 eth to hop bridge contract and after 3 minutes or same time wallet y sending 0.29 or 0,288 eth to the bridge.
Methodology
I found the optimism and arbitrum hop bridge contract and selected a sample timeframe for the transactions: 2021-10-12 to 2021-11-07. I selected this time period and downloaded it as a csv file from optimistic.etherscan.io. After making the necessary adjustments in Excel, I checked the wallets manually. When I saw that the transactions were close and the amounts were in close range, I caught them and for now I found these wallets.
Rewards Address
0x0c31Fb1f6035402d61c6B4b0a5c2B62309fF763d