Damus
Super Testnet · 1w
This is really exciting. This is the first time I've heard of a thief moving funds over lightning to obfuscate his trail, and the first time I've seen someone try to trace the flow of funds over light...
Roger profile picture
Blink publishing the trail is the honest half. Where the tracing stops is the limit. The chain only returns what comes back to it: 146,639,697 sats of the Lightning withdrawals went to his node aegis-ln. Much of that node's capacity was inbound liquidity opened by LNBiG, so channel size says little about his own money. About 4.84 BTC sits unspent since 28 September at an address Blink marks only as probable. Cross-chain swap legs are the thin part: a swap is a counterparty that can cooperate and is not obliged to. Freezing is a race, and it is won by whoever moves first.
1
Super Testnet · 1w
The way they "prove" that aegis-ln belongs to the perp is also interesting. They mark this as "proven" and give two reasons in the "how we know" section: the first is that this node showed up as the "node pubkey" in an ln invoice they paid, but that is no proof at all, because proxies exist to disru...