Multichain assets were transferred by strange IP address and CEO sister

Author: Multichain Official Source: Twitter, @MultichainOrg Compilation: Golden Finance

Summary

Since July 7, Multichain assets have been transferred out twice, totaling as much as $265 million. July 7 transfer event report July 9 abnormal transfer event report

After the accident, the community generally suspected that it was the behavior of insiders. On July 14, the Multichain team issued an event announcement. On July 7, the user assets locked on the MPC address were abnormally transferred to an unknown address, which was a Kunming IP address behavior. Assets were abnormally transferred to the EOA address controlled by Zhaojun’s sister on July 9

But at present, Zhaojun’s sister was taken away by the police and lost contact, and the team was forced to stop operating Multichain.

1. On May 21, 2023, Multichain CEO Zhaojun was taken away from his home by the Chinese police and has since lost contact with the global Multichain team. The team contacted the MPC node operators and was informed that their operational access keys to the MPC node servers had been revoked. Moreover, these MPC node servers, like other common servers, actually run under Zhaojun’s personal cloud server account. No member of the team has access to Zhaojun’s personal cloud server account, so no one can log into these MPC servers.

2. Subsequently, the Multichain team got in touch with Zhaojun’s family and learned that all of Zhaojun’s computers, mobile phones, hardware wallets, and mnemonic words were confiscated by the authorities. Since the start of the project, all operating funds and investors’ investments have been controlled by Zhaojun. This also meant that all of the team’s funds and access to the servers were in the hands of Zhaojun and the police.

3. Due to the lack of relevant information about the case, the Multichain team can only try its best to maintain the operation of the project through the remaining access rights on some non-MPC servers that have not been revoked. According to the lawyer’s suggestion, the team chose to cooperate with the request of Zhaojun’s family as much as possible, and abide by the requirements of local laws and regulations, and not to disclose unauthorized case information to the public.

4. On May 30, the team released the news of Zhaojun’s disappearance in an attitude of being responsible to the community, and informed the community of the current technical problems.

5. On June 4, Zhaojun’s family successfully logged into the cloud server platform using the historical information on their home computer. However, Zhaojun’s family only allowed Multichain team engineers physical access to the computers in his home to fix the technical problems of Router2 and Router5.

6. During this period, Zhaojun’s family members and lawyers have been communicating with the police. The Multichain team did not know the details of the case, but learned that Zhaojun was about to be released from prison and was asked to continue to maintain the system and wait for further news.

7. The Multichain protocol continued to function as designed for a time. With limited resources, the team is doing its best to maintain the operation of the Multichain protocol and solve user problems as much as possible.

8. On July 7, the user assets locked on the MPC address were abnormally transferred to an unknown address. According to sister Zhaojun, the login information of the Kunming IP address and a series of operations for transferring money from the MPC address were found on the cloud server platform.

9. On July 9, sister Zhaojun transferred the remaining user assets in the router pool, and then notified the team and multiple project parties of the asset preservation action. The funds were transferred to an EOA address controlled by Zhaojun’s sister.

0x1eed63efba5f81d95bfe37d82c8e736b974f477b

0x6b6314f4f07c974600d872182dcde092c480e57b

10. On July 13, according to the information provided by Zhaojun’s family, the police took Zhaojun’s sister away. Now, Zhaojun’s sister has also lost contact. The status of her preserved assets is uncertain, so the team felt it necessary to inform the community of all known circumstances.

11. Due to the lack of alternative sources of information and corresponding operating funds, the team was forced to stop operating Multichain. Should there be any further notices and developments, the team will update the community accordingly.

12. The Multichain team does not have access to domain accounts to redirect or close the frontend. Please help spread the word and ask users not to use Multichain services anymore.