The Fantom Foundation has been drained of hundreds of millions of dollars from its crypto wallets by a phishing scammer, according to blockchain security firm CertiK.

Fantom is a smart contract and Dapp platform focused on enhanced speed, making transactions more efficient than other layer-one blockchains like Ethereum. Tuesday’s hack affects only the Fantom Foundation – not the blockchain itself.

The foundation, which oversees development for the Fantom blockchain, lost at least $470,000 on Fantom and another $187,000 on Ethereum. According to CertiK, stolen funds have now been consolidated into a wallet holding roughly 4,500 ETH, worth approximately $7 million.

“Estimated loss is ~$7m across multiple wallets,” said CertiK.

On-chain data shows that the hacker’s wallet has received a variety of tokens from Fantom, including ETH, Tether (USDT), USD Coin (USDC), Dai stablecoin (DAI), Convex token (CVX), Fantom USD (FUSD), and others.

According to pseudonymous on-chain sleuth Spreek—who was cited by CertiK on Twitter—Fantom’s wallets may have lost as much as $6.7 million, though this amount has not yet been confirmed. A wallet possibly belonging to a team member, they said, lost $3.4 million, and other non-tagged wallets that appear to be controlled by foundation team members were also affected.

“Notably they unwound a lot of fairly complex DeFi stuff on it, so probably someone quite familiar with DeFi ecosystem,” wrote Spreek about the hacker.

Neither Certik nor the Fantom Foundation immediately responded to Decrypt’s request for comment.

The Fantom token (FTM) price fell 4.52% on Tuesday following the hack, sinking from $0.1855 to $0.1771 – a near seven-day low.

Who is Behind the Hack?

The culprit behind the Fantom hack remains unknown. But a host of multi-million dollar crypto hacks over the past few months have been traced back to the North Korean Lazarus Group. Blockchain investigators at Elliptic say the organization was likely behind the $54 million CoinEX trading platform hack in September, and the $100 million Atomic wallet hack in June.

According to Elliptic, the group is re-centering its focus on hacking centralized entities over decentralized finance protocols by using social engineering attacks.

Lazarus is also a possible suspect in the $477 million FTX hack from back in November, though Elliptic thinks Russian entities are a more likely culprit.