A group of Brazilian developers successfully recovered over $200,000 in cryptocurrency from a compromised wallet, outwitting a seasoned exploiter. The victim, whose identity remains undisclosed, had their wallet compromised, prompting them to seek the assistance of public prosecutor Alexandre Senra.

Senra, recognizing the gravity of the situation, assembled a task force of developers to recover the stolen funds. The team comprised Afonso Dalvi, DevRel and Product Manager Innovation at Web3 startup Lumx, along with Gustavo Deps and Eduardo Westphal da Cunha.

The first and most challenging step was convincing the victim to share their private key, a process that took nearly two weeks. "The hacker drained all the Ether from the wallet instantly, but there was still a significant amount of funds locked in three different DeFi [decentralized finance] applications," Dalvi explained. "It's hard to convince someone to share the keys to their treasure, and this process took two weeks."

With the private key in hand, the developers faced a race against time to gain control of the funds before the exploiter could move them. One of the DeFi applications, Pendle, had a 54-day lock feature, which the hacker had already initiated. The exploiter managed to gain access to the funds during this initial unlocking event, but the developers quickly adapted their strategy.

"We developed a flashbot to do the fund capture, but we did it manually the first time because we thought the hacker wasn't experienced. Turns out he was. Then we adapted our strategy and managed to get the funds on the next unlocking events," Dalvi shared, revealing the exploiter's prowess, having amassed $155,000 through 'sandwich attacks' in the last 30 days.

Before returning the funds to the victim, the developers conducted due diligence to ensure they weren't inadvertently assisting the exploiter. Once confirmed, they proceeded to recover the remaining funds locked in Radiant, a money market on Arbitrum, and the staking service for the PAAL AI token.

The recovery process demanded 4.4 ETH in gas fees and the assistance of an anonymous white hat hacker. Deps, one of the developers, utilized the open-source code of Flashbots, a service designed to prevent maximum value extraction (MEV) cases on Ethereum, to build the bot responsible for front-running the exploiter.

"We needed to send ETH to pay for the gas fees within the victim's wallet, then use this same amount of ETH to pay for the unlock and, finally, move the funds out of the compromised wallet. Yet, it isn't possible to do it at the same time with a regular wallet, because the three transactions must be on the same block, and a regular wallet will insert those transactions on different blocks. That's where we used the Flashbots," Deps explained.

Additionally, the developers employed a 'scavenging bot' to track transactions sent to the victim's wallet and capture funds before the exploiter could move them to another address. This bot was crucial in capturing the daily yield generated by the locked funds, which amounted to approximately $130 per day and was consistently targeted by the exploiter.

Despite the competition within the wallet and the need to apply MEV tactics, paying fees 1,400 times more expensive than regular fees, the developers' perseverance and ingenuity prevailed. While nearly $20,000 remains stuck on Radiant, the funds are being progressively returned to the victim.

This remarkable feat highlights the power of collaboration, technical expertise, and a unwavering determination to thwart malicious actors in the digital realm. As the cryptocurrency ecosystem continues to evolve, such examples of resilience and innovation serve as a testament to the community's commitment to safeguarding user funds and upholding the principles of security and transparency.