In a significant breakthrough, U.S. authorities have successfully retrieved $31 million in cryptocurrency stolen during the 2021 cyberattacks on Uranium Finance, a decentralized finance (DeFi) protocol on Binance's BNB Chain.

Understanding the Uranium Finance Exploit

Uranium Finance, launched in April 2021, functioned as an automated market maker (AMM) akin to Uniswap. However, vulnerabilities in its smart contracts were quickly exploited by hackers, leading to its untimely demise and substantial financial losses for investors.

Role of Blockchain Intelligence in Asset Recovery

Blockchain intelligence firm TRM Labs played a pivotal role in the recovery efforts. Collaborating with the Southern District of New York (SDNY) and Homeland Security Investigations (HSI) San Diego, TRM Labs meticulously tracked the stolen assets across various blockchains, leading to one of the largest asset recoveries in recent memory.

Tracing the Stolen Assets

  • In February 2023, TRM Labs identified laundering patterns and generated actionable intelligence for law enforcement.
  • By March 2023, the team had mapped out the attackers' obfuscation strategies, linking them to Tornado Cash transactions and cross-chain swaps.
  • As a result, $31 million in outstanding funds were seized by law enforcement in February 2025.

Details of the 2021 Attacks

The funds were stolen in two separate incidents in April 2021, amounting to over $53.7 million in losses. The first attack on April 6 exploited a flaw in the reward distribution system, resulting in a $1.4 million theft. Although the hacker returned $1 million, $385,500 was laundered through Tornado Cash.

The second attack on April 28 capitalized on a single-character coding error in Uranium Finance's trading logic, enabling the theft of $52 million. The stolen funds were laundered via decentralized exchanges, converted into various cryptocurrencies, and left dormant in wallets for years.

Next Steps for Victims

With over half of the stolen amount now recovered, the U.S. SDNY has urged victims of the hack to contact UraniumVictims@hsi.dhs.gov to claim their share of the recovered cryptocurrency.

Takeaway: This recovery highlights the importance of blockchain intelligence in tracing stolen assets. Learn more about zero-day vulnerabilities in our detailed Research section.

The link has been copied!