OAK — OnChain Attack Knowledge

Worked example · 2021-20

Uranium Finance — Smart Contract Exploit / $31M Seized — 2021 / 2025-02

Loss
~$50M on BSC (April 2021); $31M seized by US law enforcement (February 2025) after ZachXBT tracing.
OAK Techniques observed
OAK-T7.001 (Mixer-Routed Hop) — primary among determinable Techniques; proceeds routed through Tornado Cash. OAK-T7.003 (Cross-Chain Bridge Laundering) — bridged from BSC, consolidated on Polygon. OAK-T7.002 (CEX Deposit-Address Layering) — final consolidation, where the February 2025 $31M seizure landed. No T9 sub-Technique is tagged: the file asserts a smart-contract exploit but never describes the vulnerability class, so none is derivable from its own text. The seizure is outcome, not mechanism.
Attribution
confirmed — suspect traced by ZachXBT in December 2023 investigation. US law enforcement seized $31M of the stolen funds in February 2025.
Key teaching point
Uranium Finance demonstrates the long-tail exploit tracing and seizure pattern: the exploit was in April 2021, the on-chain tracing investigation was published in December 2023 (2.5 years later), and $31M was seized in February 2025 (nearly 4 years after the hack). The immutable ledger is both the attacker's vulnerability (the trail never disappears) and the investigator's tool (tracing is time-invariant). Detection approach: cold-case on-chain tracing — re-examine old exploits with new clustering and cross-chain tracing techniques that were not available at the time of the hack.

Summary

In April 2021, Uranium Finance on BSC was exploited for ~$50M. The exploiter laundered funds through Tornado Cash and cross-chain bridges.

In December 2023, ZachXBT published an investigation tracing the $50M through laundering paths, identifying how the attacker bridged funds and consolidated to exchange accounts. The investigation noted a clear trend of 2021-2023 funds being withdrawn from Tornado Cash and bridged to Polygon before consolidation.

In February 2025, US law enforcement announced the seizure of $31M from the Uranium Finance exploit — nearly 4 years after the hack. ZachXBT's tracing was instrumental in the seizure. An additional $10.5M was identified in related funds.

Timeline

When Event OAK ref
2021-04 Uranium Finance exploited for ~$50M on BSC T9 exploit
2021~2023 Funds laundered through Tornado Cash, bridges, Polygon consolidation T7 laundering
2023-12 ZachXBT publishes tracing investigation (investigation)
2025-02 US law enforcement seizes $31M. $10.5M additional identified (seizure)

What defenders observed

  • Tornado Cash → Polygon bridge → CEX consolidation: The laundering pattern was consistent across multiple 2021-2023 exploits (not just Uranium Finance). The bridge-to-Polygon hop was the distinguishing feature of this era's laundering methodology.
  • Immutable trail: The on-chain trail was 2.5+ years old when ZachXBT traced it. Blockchain transactions are time-invariant — the trail does not degrade. This is structurally different from traditional financial crime investigation where records age out.
  • Seizure as the endgame: The $31M seizure demonstrates that exploit tracing is not just an academic exercise — it leads to asset recovery even years later. The on-chain investigation is the prerequisite for law enforcement action.

What this example tells contributors

  • Cold-case tracing is a standard OAK investigation methodology. Exploits from 2021 are traceable in 2025 using techniques (cross-chain tracing, mixer deanonymization) that were less developed at the time. OAK investigation methodology should include "re-trace old exploits with current techniques" as a standard step.
  • BSC → ETH bridge → Tornado Cash → Polygon → CEX was a 2021-era laundering template. This specific path was used across multiple exploits. T7 laundering technique pages should catalogue era-specific laundering templates that become dated and identifiable over time.
  • Seizure is a detection metric. For OAK spec writers: the fact that $31M was seized means the tracing was successful. "Funds seized" is a validation metric for detection spec effectiveness.

Public references

Techniques demonstrated (3)