Multichain exploit timeline: CEO custody, lost MPC access and drained funds
Thread536 words
Reconstructs the Multichain collapse from the team's account: the CEO's detention on 21 May, loss of MPC server access, unexplained transfers on 7 July and the winddown. Concludes it shows autonomy is key.
Key claims
CEO Zhaojun was taken into custody on 21 May and controlled the MPC servers
User assets on MPC addresses were moved on 7 July
The team is winding down and urges users to stop using the service
0/ slowly the mystery starts to unravel and what started as just another bridge exploit last week is turning into the storyline of the next big Netflix true crime documentary 🤯
a deep look into the dark secrets of the @MultichainOrg exploit 🥷
🧵 (0/15)
1/ 🚔 The Beginning - May 21:
on this date, @Multichain CEO Zhaojun was unexpectedly taken into custody by Chinese authorities from his home. Since then, he has remained out of touch with the global #Multichain team
2/ the team discovered their access keys to the MPC node servers had been revoked, which were all under Zhaojun's personal cloud server account
3/ 👨👩👦 Contact with Zhaojun's Family:
the team made contact with Zhaojun's family and learned that the authorities had seized all of Zhaojun's electronics, hardware wallets, and mnemonic phrases
4/ Zhaojun held exclusive control over the project's operational funds and investments, which meant that the team's funds and server access were now in possession of Zhaojun and the authorities
5/ ⚙️ Maintaining Operations and Compliance:
without much information about the case, the team endeavored to maintain project operations with access to some non-MPC servers
6/ they have cooperated fully with Zhaojun's family and local laws, avoiding the release of unauthorized case information to the public
7/ 📣 Informing the Community - May 30:
the team responsibly informed the community about Zhaojun's disappearance and the technical challenges currently being faced
8/ 🤕 Gaining Limited Access - June 4:
Zhaojun's family managed to log into the cloud server platform using information from his home computer. However, they only allowed the @Multichain team physical access to the computer to address specific technical issues
9/ 🏛 Communication with Authorities:
while the family and lawyer liaised with the police, the team received word that Zhaojun would be released soon and were advised to continue system maintenance
10/ ⛓ Multichain Protocol Operations:
throughout this ordeal, the team made every effort to ensure the #Multichain protocol functioned as intended, resolving user issues as much as possible with limited resources.
11/ 💸 Abnormal Asset Transfers - July 7:
user assets locked on MPC addresses were unexpectedly transferred to unidentified addresses. Zhaojun's sister found login details from an IP address in Kunming on the cloud server platform, along with a series of fund transfers
12/ 🔒 Asset Preservation Actions - July 9:
to safeguard remaining user assets in the router pool, Zhaojun's sister moved the funds to EOA addresses under her control and notified the team and other project parties
13/ 👻 Zhaojun's Sister's Disappearance - July 13:
according to the family, the police have now taken Zhaojun's sister into custody, and her whereabouts are unknown. The status of the preserved assets is also uncertain
14/ 💀 Ceasing Operations:
due to a lack of alternative information and operational funds, the team is forced to wind down operations. The team will keep the community updated on any further notifications or developments
15/ ⚠️ Warning to Users:
the team does not have access to the Domain Account to redirect or shut down the front-end of multichain.org. They hence urge everyone to refrain from using the @Multichain service and help spread the word 🚨
16/ proves that autonomy is key 👇
x.com/DefiIgnas/status/1679806976564383745
1 image on X