We share an important post and research by a Q member, since it also involves
$wQUIL
🚨
@XTexchange : Urgent Call for Accountability and Transparency 🚨
We demand the immediate purchase of missing tokens, the restoration of withdrawals, and the cessation of false claims by
@XTexchange .
On November 28, 2024,
#XTExchange experienced a security breach resulting in the theft of approximately 494 ETH (~$2M).
Contrary to recent announcements claiming the full resumption of withdrawal services, the affected tokens remain inaccessible, and users face censorship when seeking clarification.
It appears that XT is attempting to pass the losses from the hack onto users holding the affected tokens by spreading misleading information to both users and the press. We will not allow this to continue. It is clear that
#XT has not yet compensated its users, who can neither withdraw the affected tokens nor trade them on the market due to a lack of liquidity.
We demand that
#XT:
>> Immediately reacquire the stolen tokens
>> Reopen withdrawals without further delay
>> Provide transparent and truthful information instead of trying to cover up the incident
🔍 Summary of the Incident:
>> Date of Attack: November 28, 2024
>> Amount Stolen: 494 ETH ($2M)
Technical Details:
>> The EVM address of
#XT has been compromised
>> Eight ERC20 tokens on the Ethereum network were transferred to an attacker's address and can be easily viewed here:
etherscan.io/tokentxns?a=0x4…
>> The funds were subsequently exchanged into ETH (~465 ETH) and sent to:
etherscan.io/address/0xb43ff…
Stolen Tokens:
>> 7,849,266
$wQUIL @QuilibriumInc (> $1M)
>> 1,775,405
$DOGE @doge_eth_gov (> $0.5M)
>> 1,116,459,224
$WOLF @Wolf0x67 (~$170k)
>> 92,804
$TRUMP @MAGAMemecoin (~$150k)
>> 515,352,289
$FLOKI @RealFlokiInu (~$120k)
>> 164,267
$ZND @ZND_co (> $100k)
>> 776,968
$ASTRA @astraprotocol (> $2k)
>> 91,974
$USDT @tether
The first to report the hack was
@PeckShieldAlert a few hours after it happened:
nitter.app/PeckShieldAlert/status…
50 minutes after
#PeckShieldAlert's report,
@XTexchange posted a tweet and an announcement about an 'abnormal transfer':
nitter.app/XTexchange/status/1862… assuring: 'Rest assured, this will not affect our users. [...] We always maintain reserves 1.5x greater than user assets to ensure maximum security.'
In addition, XT announced the closure of all withdrawals:
xtsupport.zendesk.com/hc/en-… and issued further reassurances:
"Rest assured. Users' assets are always safe! We are solving the problem and all will be back to normal soon.":
nitter.app/XTexchange/status/1862…
"Rest assured, users' assets remain safe and unaffected.":
nitter.app/XTexchange/status/1862…
On the same day, XT states that 'Withdrawal services will gradually resume starting 00:00 (UTC) on Nov 29, 2024, with full restoration within 24 hours.'
nitter.app/XTexchange/status/1862…
On 2 December, XT officially announced that 'XT has now fully resumed withdrawal services for all tokens.'
xtsupport.zendesk.com/hc/en-…
❌ The Truth Behind XT's Statements:
1️⃣ Withdrawals NOT Resumed:
>> The tokens involved in the hack are not withdrawable
>> The claim of 'technical maintenance' is hardly credible, as other Ethereum wallets are functioning normally
>> Evidence indicates that XT no longer owns these tokens and has not yet used its reserves to repurchase them
2️⃣ Missing Assets:
>> Checking the address of XT's user deposits (the one from which the funds were hacked):
etherscan.io/tokenholdings?a…
>> The hacked tokens have not yet been re-entered
3️⃣ No Liquidity for Exchanges:
>> Comparison between the chart of
$DOGE on XT (white) and Uniswap (black)
>> The last trade on XT is priced 25% below the market value on Uniswap
>> A sale of only $1,000 on the market would decrease the price by 50%, and $3,000 would decrease it by 75% compared to the Uniswap price
>> On some days, the average price on XT was 1/3 of the actual value
>> These quotations and the lack of liquidity reflect owners' fears about the reliability of XT
4️⃣ User Censorship:
>> We report only one conversation in which two users are mutated only because they ask about the opening of withdrawals of a token (among those involved in the hack) because it was exhaustive, and we received dozens of witnesses of banned users and deleted messages
>> On the left, two screens show a conversation in XT's Telegram chat. The first screen was sent to us by 'Emanuele' himself, and as you can see, was mutated (shortly after the admin's reply)
>> On the right, a screenshot shows a person talking to "Igor," who joked that if he entered the group to ask about withdrawals, he would be banned immediately. As soon as he asked, he was banned within less than five minutes, as evidenced by the timestamps
Translation of the Conversation:
>> Igor: "What did I tell you?"
>> Person: "Have you already been banned?"
>> Igor: (Displays restrictions screen)
⚠️ Further Details on the Hack:
Additional Tokens Involved:
>> The attacker's transactions did not only involve eight tokens mentioned earlier. Tey also involved 4 other tokens, none of which are listed on any centralized exchanges, all reported by DexScreener as honeypots. The exact role these tokens played in the hack remains unclear
>> The attacker bridged 1 ETH on Optimism and executed a "Proof Withdrawal Transaction," authorizing the transfer of more funds via a bridge from Optimism to Ethereum. This action requires a challenge period of seven days
>> Yesterday, on December 5, the attacker executed a "Finalize Withdrawal Transaction" that allowed them to collect approximately 29 ETH
etherscan.io/address/0xbeb5f…
We have analyzed the attacker's transactions and can confirm that today's event represents the completion of the November 28 hack. This means the attacker can no longer extract any more funds from XT's address.
The 29 ETH obtained by the hacker were acquired by swapping the following assets:
optimistic.etherscan.io/tx/0…
Swapped Assets are:
$OP,
$WETH,
$wstETH,
$USCD,
$VELO,
$alUSD,
$alETH,
$FRAX,
$frxETH,
$USDC,
$GIV,
$DAI,
$USDT,
$USD+,
$CRV,
$LINK,
$WBTC
The total amount gained by the hacker amounts to approximately 494 ETH (~ $2M)
📢 Appeal to the Community and XT:
Demand for Accountability:
We will not accept silence and false announcements from XTExchange. Users of
$wQUIL and other affected communities deserve transparency and justice.
Our Demands:
>> Repurchase the stolen tokens
>> Restore withdrawals immediately
>> Allow unrestricted communication channels and provide truthful information regarding the incident and ongoing recovery efforts
Together we can make a difference. Let's not let
#XT harm our or other communities.
$wQUIL $QUIL #XTExchangeRespond #XT $DOGE $BONK $WOLF $TRUMP $FLOKI $ZND $ASTRA $USDT @QuilibriumInc