Analysis: Suspected North Korean hackers transferred approximately 1.46 million USD through the cross-chain bridge between Jupiter Lend and Circle, with Jupiter stating that the source of the funds has not been cut off

On-chain analyst @FabianoSolana posted that suspected North Korean hackers transferred approximately $1.46 million through the Jupiter Lend and Circle cross-chain bridge. According to his analysis, the funds were initially transferred from a Solana wallet address marked by the FBI (starting with AffzFD), then dispersed to about 35 temporary addresses via intermediary wallets before being re-aggregated and deposited into Jupiter Lend. A few minutes later, a similar amount was withdrawn by another new wallet.

Subsequently, the funds were exchanged for USDC and transferred out of Solana through the Circle cross-chain bridge, returning to a new address on the Solana network via Noble and dYdX. The related funds were transferred out in approximately 16 transactions totaling about $1.4634 million, and then returned in 19 transactions, with a difference of about $10 between the amounts transferred out and returned. According to the analyst, the related funds have not been frozen.

In response, Jupiter's Chief Operating Officer Kash Dhanda stated that based on the current investigation results, the attackers only performed deposit and withdrawal operations through Jupiter Lend, which is different from the previous Aave incident where stolen stablecoins were borrowed and could not freeze the assets. The flow of related funds can still be fully tracked through LP tokens, and the relationship of the funds has not been severed, so it cannot be concluded that the attackers used Jupiter Lend to launder the source of the funds. The Jupiter security team has been monitoring the flow of related funds in real-time. As of the time of publication, Circle has not publicly responded to the reasons for the aforementioned fund transfer and why they have not been frozen.