On Tuesday, new NFT exchange SudoRare went live, but turned out to be nothing more than a rugpull. Right after launch, the exchange’s owners ran off with $820 thousand in various cryptocurrencies.
The exchange SudoRare was founded by an anonymous team. The goal was to let users build liquidity pools for NFT collections and earn fees by staking the native token SR.
820 thousand dollars within six hours
This is called a rugpull in the crypto world (the rug is pulled out from under you). SudoRare’s website and social media profiles were also immediately taken offline and the exchange was only operational for six hours.
Before the creators of SudoRare tried to erase every digital trace, they got away with $820 thousand in cryptocurrency. Indeed, within six hours of going live, users had already deposited cryptocurrency on the exchange to buy NFTs with.
Researchers track stolen crypto
Data from on-chain analytics platform PeckShield shows that the crypto has already been transferred to three separate wallets.
PeckShield and other researchers assume that the founders of the project are responsible. They come to this conclusion because the hack occurred so incredibly quickly after the launch. At that time, his were the only ones who had access to the liquidity in the pool.
According to PeckShield, at least one of the attackers appears to have sent coins from the US crypto exchange Kraken in the past. Etherscan data shows coins were sent from Kraken on August 21 to an Ethereum wallet starting with 0x814.
That wallet transferred 0.28 ETH to 0xbb4 earlier today, hours before SudoRare withdrew $820,000 worth of WETH, XMON and LOOKS and removed its online channels. The wallet is one of several addresses used during the attack. The latest interaction was a transaction of 173.1 ethers today. Against the current Ethereum price is $280,572.
Does Kraken know who is responsible?
In short, one of the members of the SudoRare team has an account and a wallet with Kraken. Kraken must perform mandatory identification checks on each of its customers because of U.S. know-your-customer rules. This means that at least one person involved in the attack may be known to Kraken.
Each Kraken customer must submit identification before they can use the exchange, and Kraken tracks their activity. In other words, if the 0x814 wallet belongs to a member of the SudoRare team, Kraken may have details about their real identity.
Anonymity not always a good thing
Before the NFT fair was launched, many were skeptical. For example, one tweet read that SudoRare could be a scam: “Don’t join unless you want to risk losing your money. This team is anonymous, will not disclose their identity, and the chances of this being a scam are high.”