Worked example · 2024-01

Concentric Finance multisig signing-key social-engineering compromise — Arbitrum — 2024-01-22

Loss: approximately $1.7M extracted from Concentric Finance's vaults on Arbitrum on 2024-01-22. Concentric is an Arbitrum-side automated liquidity-management protocol; the loss-bearing surface was the protocol's vault contracts, drained via a malicious upgrade pushed by an attacker who had obtained the private key of one of the protocol's multisig signers through a social-engineering compromise of the signer's developer machine.
Recovery: none of material consequence on the on-chain layer. Proceeds were laundered through Tornado Cash within the days following the incident. Concentric's response was protocol-level pause and disclosure; there is no public DOJ / civil-forfeiture action.
OAK Techniques observed: OAK-T11.001 (Third-Party Signing / Custody Vendor Compromise) broadly construed — the attacker's entry vector targeted the operational signing posture of one of Concentric's multisig signers (a developer with private-key control of one of the multisig participants), via a fabricated-job-offer / fabricated-investor lure that delivered a payload onto the developer's machine. OAK-T15.001 (Social Engineering of Operator Personnel) — the canonical small-multisig-protocol anchor for the fake-job-offer / fake-investor pretext targeting a single signer. OAK-T15.003 (Operator-Endpoint Compromise) — the multisig signer's developer workstation was the load-bearing endpoint state; the host-side malware harvested private-key material from the local wallet-software environment. OAK-T11.002 (Wallet-Software Distribution Compromise) — the host-side malware deployed by the social-engineering chain harvested the private-key material from the developer's local wallet-software environment, converting the social-engineering entry into private-key extraction. OAK-T9.004 (Access-Control Misconfiguration) — once the attacker controlled signer power on the multisig, they pushed a malicious upgrade to the vault contracts that drained the assets, executing the extraction phase on-chain. OAK-T7.001 (Mixer-Routed Hop — proceeds were laundered through Tornado Cash).
Attribution: inferred-strong OAK-G01 / TraderTraitor cluster. Industry consensus across SlowMist, Cyvers, PeckShield, and Match Systems converges on the TraderTraitor playbook — fake-job-offer / fake-investor LinkedIn / Telegram lure → developer-machine compromise → private-key extraction → multisig-bypass / malicious-upgrade extraction. The DPRK / OAK-G01 attribution is not at the level of FBI / Treasury named-actor designation for this specific incident, but the pattern fingerprints are sufficiently distinctive to warrant inferred-strong status at OAK's convention; the case sits in the same operator-pattern cohort as DMM Bitcoin May 2024 (/examples/2024-05-dmm-bitcoin.md), Radiant Capital October 2024 (/examples/2024-10-radiant-capital.md), and the broader TraderTraitor 2024 cohort.
OAK-Gnn: OAK-G01 Lazarus Group / DPRK-attributed.
Key teaching point: Concentric Finance is the first publicly-documented 2024 OAK-G01 / TraderTraitor cohort case chronologically, predating DMM Bitcoin (May 2024), WazirX (July 2024), Radiant Capital (October 2024), and DeltaPrime (September 2024). The case is operationally important not for its dollar-loss magnitude — $1.7M is small relative to the headline 2024 cohort cases — but for its position as the early signal in the 2024 G01 wave: the same operator-pattern fingerprints, the same social-engineering-into-developer-machine entry vector, the same multisig-signer / private-key extraction chain, the same Tornado Cash laundering tail. Defender takeaway: by January 2024 the playbook was already fully operational against the Arbitrum-side DeFi cohort; the larger 2024 cases were not "novel emergence" but "continued execution at scale" of a vector that was already producing extractions from much smaller targets.

Summary

Concentric Finance is an Arbitrum-side automated liquidity-management protocol that provides actively-managed concentrated-liquidity positions on Uniswap v3 and other concentrated-liquidity AMMs. The protocol operates through vault contracts that hold user-deposited LP positions; the vaults are upgradeable, with upgrade authority held by a multi-signature wallet collectively controlled by the protocol's core team.

On 2024-01-22, an attacker pushed a malicious upgrade to Concentric's vault contracts via the protocol's multisig. The malicious upgrade implemented a function that drained the vault's underlying tokens to attacker-controlled addresses; once deployed, the attacker invoked the function and extracted approximately $1.7M.

The proximate on-chain step was the multisig-authorised malicious upgrade; the operational entry vector was off-chain. According to the protocol's post-incident statement and converging industry forensic write-ups (SlowMist, Cyvers, PeckShield, Match Systems), one of the multisig signers' private-key material had been compromised via a social-engineering chain executed against the signer's developer machine. The entry vector pattern matches the canonical OAK-G01 / TraderTraitor playbook: a fabricated job-offer, fabricated investor pitch, or fabricated technical-counterparty interaction is delivered to the target signer over LinkedIn / Telegram / Discord; the lure progresses to a request to download or execute a payload framed as a coding test, technical demo, or due-diligence document; the payload is malware designed to harvest private-key material, browser-stored credentials, and wallet-software state from the target's machine. The harvested signer private key gives the attacker enough multisig power to execute high-value upgrade transactions, with the extraction step occurring on-chain.

For OAK's purposes the case is a clean T11.001 + T11.002 (off-chain operational compromise of signing infrastructure / wallet software) + T9.004 (on-chain access-control misuse via malicious upgrade) chain. The OAK contribution of the worked example is its chronological position as the first publicly-documented 2024 OAK-G01-cohort case, providing the corpus with a January 2024 anchor that establishes the pattern was already operational at the start of the year.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Concentric Finance deploys vault contracts on Arbitrum with upgrade authority via multi-signature wallet; signer set includes core team developers	(operational signing surface)
Pre-event (weeks-months)	OAK-G01 / TraderTraitor cohort operator engages target signer via LinkedIn / Telegram / Discord under fabricated job-offer or investor-counterparty persona; rapport-building over days-to-weeks before payload delivery	T11.001 entry vector (off-OAK pre-event observation)
Pre-event (days)	Signer downloads / executes payload framed as coding test, technical demo, or due-diligence document; malware deployed to developer machine; private-key material harvested from local wallet-software environment	T11.002 (wallet-software / signing-host compromise)
2024-01-22 (attack tx window)	Attacker uses harvested signer private key to authorise malicious upgrade to Concentric vault contracts; deploys upgrade implementing drain function; invokes drain function; ~$1.7M extracted	T11.001 + T11.002 + T9.004 extraction
2024-01-22 (within hours)	On-chain monitoring (Cyvers, BlockSec PhalconHQ, others) flags anomalous upgrade-and-extraction pattern	(defender response / community detection)
2024-01-22 (within hours)	Concentric operations team detects the drain; pauses affected vaults; rotates remaining signing infrastructure; publishes initial public statement	(operator response)
2024-01-22 onward	SlowMist, Cyvers, PeckShield, Match Systems publish post-incident write-ups converging on TraderTraitor-pattern entry vector; OAK-G01 attribution at inferred-strong level	(attribution / cohort signal)
Days following	Attacker laundering routes proceeds through Tornado Cash	T7.001 (off this example's framing)
2024-Q1 onward	Pattern recurs across larger 2024 cohort cases — DMM Bitcoin (May), WazirX (July), DeltaPrime (September), Radiant Capital (October) — establishing Concentric as the chronological early signal	(cohort signal)
Continuing	No public recovery; no civil-forfeiture action; OAK-G01 attribution remains inferred-strong	(recovery / attribution state)

What defenders observed

The on-chain phase was a malicious upgrade authorised by a legitimate multisig signer key. From on-chain telemetry alone, the upgrade transaction was a normally-formatted multisig-signed upgrade execution; the signer key used was one of the multisig's authorised participants. Detection from on-chain telemetry of malicious-upgrade-via-compromised-signer events requires monitoring of upgrade transactions and post-upgrade-behaviour anomaly detection, not simple authorisation-check; the compromised signer's authorisation looks valid by every on-chain check.
The off-chain entry vector is the load-bearing failure surface. Once the signer private-key material was harvested, the on-chain execution was effectively pre-determined; the attacker's degrees of freedom were bounded only by what the multisig's authorisation gave them, which in this case included full upgrade authority. Defender investment should concentrate on preventing the off-chain compromise (developer-machine endpoint hardening, anti-phishing training particularly against LinkedIn / Telegram fake-job-offer lures, hardware-wallet enforcement for high-value signing) rather than on detecting the on-chain phase, where the detection-to-recovery window is structurally too short.
The TraderTraitor cohort fingerprints by January 2024 were already well-documented. CISA AA22-108A from April 2022 had already characterised the operator-pattern. The April 2022 advisory's specific TTPs — LinkedIn / Telegram social-engineering lures, fabricated job offers, payload delivery via coding-test or due-diligence framing, host-side malware harvesting wallet-software state — match the Concentric case's reconstructed entry vector with high specificity. The 2024 industry-forensic-side attribution at inferred-strong is supported by this fingerprint match plus the laundering-pattern overlap with other confirmed-G01 cases of the same period.
The multisig posture amplifies the loss when any single signer is compromised. Concentric's multisig's specific m-of-n threshold and signer-set composition were such that one compromised signer's private key gave the attacker sufficient authority to push the malicious upgrade. Multi-party computation (MPC) custody schemes, hardware-wallet enforcement for all signers, and signer-set diversity (multiple operational/geographic / trust domains for the signer set, per OAK-M15 Threshold Signing with Operator Separation) are the canonical mitigations. The Concentric case is the early-2024 evidence that uniform adoption of these mitigations across the Arbitrum-side DeFi cohort was not yet operational.
Detection latency was operator-acceptable; recovery latency was effectively infinite. Concentric paused within roughly hours. Funds were already moving toward Tornado Cash by then. The pause primitive protects future drains but does not unwind completed extraction; the same shape as Onyx 2024, Li.Fi 2024, and the broader 2024 EVM-mainnet exploit cases.

What this example tells contributors writing future Technique pages

OAK-G01 / TraderTraitor cohort attribution at inferred-strong is the realistic attribution status when industry-forensic-side fingerprint match is robust but FBI / Treasury named-actor designation is absent. Contributors writing future cohort cases should follow the OAK convention: confirmed status requires government attribution; inferred-strong applies when industry-forensic-side fingerprint match is documented across multiple independent sources; inferred-weak applies when single-source attribution is the only available basis. The Concentric case is at inferred-strong because four independent industry-forensic sources (SlowMist, Cyvers, PeckShield, Match Systems) converge on the TraderTraitor-pattern attribution.
Chronological position of an early-cohort case is itself a load-bearing OAK observation. Concentric is the first publicly-documented 2024 OAK-G01-cohort case. Worked examples should preserve the cohort-position dimension explicitly: not just "this incident happened" but "this incident is the early signal in a cohort that subsequently produced N cases of cumulative loss $X". The corpus's cohort-tracking utility depends on explicit cohort-position observation.
T11.001 + T11.002 + T9.004 chains are the canonical OAK-G01 cohort attack chain for 2024. The same chain structure recurs across DMM Bitcoin May 2024, WazirX July 2024, DeltaPrime September 2024, Radiant Capital October 2024. Future T11 / T9 worked examples should preserve the chain structure rather than collapsing to a single Technique classification; the Mitigations layer for each chain stage is structurally different (anti-phishing training and endpoint hardening for T11.001, wallet-software hygiene for T11.002, multisig posture and upgrade-authority audit for T9.004).
The OAK convention on industry-forensic-side fingerprint-match attribution should be tightened in the v0.x → v0.5 transition. The Concentric case is an inferred-strong attribution; this is realistic in early 2024 but the 2024 cohort's repeat-pattern across multiple cases makes the cluster-level attribution increasingly robust. Contributors writing v0.5 should consider whether the OAK attribution-strength scale warrants a third confirmed-cluster-but-not-confirmed-actor tier specifically for cases like this, where the cluster fingerprint is sufficient for cluster-level attribution even when no government named-actor designation applies to the specific incident.

Public references

[concentricpostmortem2024] — Concentric Finance protocol-side post-incident statement covering the multisig-signer compromise, the malicious upgrade root cause, and operational response.
[slowmistconcentric2024] — SlowMist incident analysis covering the TraderTraitor-pattern entry vector and Tornado Cash laundering tail.
[cyversconcentric2024] — Cyvers real-time monitoring alert and post-incident forensic post on the Concentric drain.
[peckshieldconcentric2024] — PeckShield headline figures and on-chain analytics for the Concentric extraction.
[matchsystemsconcentric2024] — Match Systems forensic analysis tying Concentric laundering pattern to the broader 2024 OAK-G01 cohort.
[cisaaa22108a] for the canonical CISA / FBI / Treasury TraderTraitor advisory whose TTPs match the Concentric entry vector.

Discussion

Concentric Finance January 2024 is OAK's canonical early-cohort signal for the 2024 OAK-G01 / TraderTraitor wave. The case's analytical importance is structural — it establishes that the playbook was operational at the start of the year, against a smaller Arbitrum-side DeFi target, with the same fingerprints that would recur across DMM Bitcoin (May), WazirX (July), DeltaPrime (September), and Radiant Capital (October) at substantially larger dollar magnitudes.

The cohort framing is the analytically important feature. By 2024, the OAK-G01 operator pattern was no longer a novel APT TTP — it was an industrialised, repeatable extraction chain that produced $1.7M from a small DeFi protocol in January and was producing nine-figure extractions from larger crypto firms by year-end. The pattern's industrial maturity is itself the signal. Defender investment in the corresponding mitigations (anti-phishing training particularly against LinkedIn / Telegram fake-job-offer lures, developer-machine endpoint hardening, hardware-wallet enforcement, MPC custody schemes, signer-set operational diversity) was uneven across the ecosystem in early 2024; the cohort's success rate through 2024 is the evidence that uniform adoption was still distant.

The within-cohort comparison with subsequent 2024 cases is instructive. Concentric, DMM Bitcoin, WazirX, DeltaPrime, and Radiant Capital are not five different attack patterns — they are five executions of the same pattern against five different targets, with operational refinements between each but the same load-bearing structural shape. The OAK Mitigations layer should treat the entire cohort as evidence for a single Mitigation-priority observation: the social-engineering-into-developer-machine entry vector is the single highest-value defender investment surface for the 2024 DPRK financial-targeting cohort, and uniform adoption of OAK-M15 (Threshold Signing with Operator Separation), OAK-M18 (Out-of-Band Destination Verification), OAK-M21 (Anti-Phishing Training), and OAK-M22 (Rotate-on-Disclosure Discipline) across the cohort would have prevented or substantially mitigated all five cases.

For OAK's broader credibility, including Concentric in v0.1 closes a chronological gap in the 2024 cohort coverage: the corpus had DMM Bitcoin, WazirX, DeltaPrime, and Radiant Capital as headline 2024 cases but lacked the early-2024 anchor that established the pattern's operational maturity at the start of the year. Concentric fills that role and provides the cohort-tracking utility that the OAK Threat-Actors and Mitigations layers depend on.