Recent activities have raised concerns after a report emerged showing that several crypto wallets affiliated with the US government have been hacked, with $20 million lost.
The data obtained by Arkham Intelligence indicate that the stolen funds were mainly withdrawn in stablecoins, and the conversion into Ethereum was made through addresses suspected of money laundering. On-chain analysts paid further attention to it due to new suspicious transactions, as Arkham mentioned in the post on October 24.
Arkham Intelligence noted significant activity in government-linked crypto wallets, sparking theories that hackers accessed addresses tied to funds previously seized from high-profile cases like the Bitfinex hack in 2016.
On-chain data reveals that addresses linked to government seizures, including one tagged “0xc9E,” received assets from wallets associated with this hack. After moving assets from these addresses, Arkham observed that wallet “0x348” began selling portions of the stolen funds and converting them into Ethereum.
The breach has raised questions about the security protocols for these seized assets. Transactions tied to wallets previously linked to Bitfinex hackers Ilya Lichtenstein and Heather Morgan include transfers of Tether, USDC, and Ethereum and withdrawals from decentralised finance (DeFi) platforms like Aave.
Arkham has shared details from court documents related to the Bitfinex hack case, which cite multiple DeFi platforms, including Yearn Finance and Curve Finance, as sources for some of the seized funds.
According to Arkham’s analysis, a substantial amount—over 3.6 million USDT—was housed in Yearn Finance’s liquidity pools under addresses now linked to the government. Yet the funds appeared to be moved to wallet “0x348,” which reportedly funnelled them to external addresses associated with laundering services.
On-chain analyst Ergo BTC noted possible inconsistencies between reported data and the actual flow of these resources on-chain. Accordingly, Ergo claimed that some of the digital currency was identified with specific IDs (txids), and the custody status of the assets suggests some may have yet to officially be transferred to the US Marshals Service (USMS) despite being marked as seized.
Ergo pointed out that these funds had been spent to an extent, including 74 BTC, which originated from seized transaction outputs, a shocking revelation, seeing that those funds were presumably in the possession of the federal authorities.
Furthermore, it can also be observed that 3,100 BTC linked with seizing activity seem to have been transferred, which is not reported in the seizure lists. Accordingly, Ergo claims that these undercover transitions might indicate security vulnerabilities in government agencies' disposal of seized digital property. Such inconsistencies also make it hard to understand what protective measures to take on assets or where the seized funds have been taken.