In April of last year, a hacker exploited a vulnerability in the Optimism-based DeFi protocol, Hundred Finance, stealing $7.4 million.

After a year of inactivity, the stolen funds have begun moving.

Around 10:25 am London time on Wednesday, the hacker withdrew nearly $800,000 worth of Ether and Tether's USDT stablecoin from the decentralized exchange Curve, where the hacker had provided liquidity with the tokens over a year ago.

Following the withdrawal, the hacker used Uniswap to convert USDT and smaller amounts of other cryptocurrencies like PAXG, WOO, FRAX, and DAI into Ether.

The transactions increased the hacker’s Ether holdings by over $1 million.

The hacker's wallet now contains $4.2 million in Ether, $1.2 million DAI, $859,000 in Synthetix’s sUSD stablecoin, and smaller amounts of Wrapped Ether, FRAX, SNX, and Wrapped Bitcoin.

It's unclear why the hacker has decided to move the funds now. If the hacker is still in control of the wallet and the transactions, they may be preparing to cash out the stolen funds.

Hackers often convert stolen crypto into Bitcoin or Ether for easier conversion to fiat currency.

Cashing out may prove difficult for the hacker, as they would need to break the traceability of the funds linked to the wallet used in the hack.

Hackers previously used crypto mixers like Samourai Wallet and privacy protocols like Tornado Cash to launder funds, but regulators worldwide are clamping down on these methods.

On April 24, the European Parliament voted to ban crypto mixers as part of new anti-money laundering regulations.

The next day, the US Department of Justice charged two founders of the crypto mixer Samourai Wallet with conspiracy to commit money laundering and operate an unlicensed money-transmitting business.

In the case of Samourai Wallet, US authorities took control of the servers, making it inoperable.

Regulatory actions have discouraged users from employing crypto mixers and privacy protocols. In September 2022, developers at the privacy protocol Tornado Cash noted that low liquidity made it difficult for users to mix even $100.

The Hundred Finance hack: A year later

Hundred Finance was a protocol forked from the lending protocol Compound v2, allowing users to lend and borrow crypto.

On April 15, 2023, a hacker used a bug in Hundred Finance's code to steal approximately $7.4 million from depositors.

Hundred Finance once managed over $300 million in assets.

The hacker exploited a rounding error in the protocol's handling of withdrawals, allowing them to use a small amount of Wrapped Bitcoin as collateral to withdraw more assets than they should have been able to.

After the exploit, Hundred Finance offered a $500,000 reward for information leading to the arrest of the hacker and the recovery of the stolen assets.

The protocol later tried to negotiate the return of the funds by offering the hacker 10% of the stolen funds (about $740,000) for the safe return of the remaining 90%.

Both attempts to recover the stolen funds failed, and on August 9, Hundred Finance token holders voted to shut the project down.