funds

According to on-chain analyst Specter, North Korea is laundering funds across multiple chains, including underlying chains such as dYdX, Noble, and Osmosis, and has opened perpetual contract positions on dYdX.

Goldman Sachs Global Investment Research Department's South Korea stock analyst Chris Cha stated in a report on September 23 that KOSPI has the conditions for a short-term tactical breakout, but the continuous flow of liquidity from South Korean retail investors into the cryptocurrency market will make the index's subsequent upward movement more reliant on foreign capital and local institutions reconfiguring. The report noted that concerns about the Federal Reserve's interest rates have been partially digested by the market, and risk appetite has shifted towards proxy AI themes.The report pointed out that South Korean memory chips provide fundamental support, with fourth-quarter DRAM contract prices expected to grow double digits quarter-on-quarter, and the ramp-up of HBM4 capacity will continue to limit the supply of standard server DRAM. Samsung Electronics' large shareholder returns, continuous buying by institutions, and foreign capital turning into net buying may drive KOSPI towards the resistance zone of 7000 to 7200 points.The report also indicated that the capacity of local South Korean retail investors to absorb has weakened. After Bitcoin returned to $85,000, cryptocurrency trading in South Korea has heated up. According to DefiLlama data cited in the report, Upbit's single-day spot trading volume on June 13 was approximately $770 million, which rose to $1.817 billion on September 22, an increase of about 136%. Based on the total trading volume of $3.27 billion on that day across South Korea's five major trading platforms, Upbit alone accounted for over half. Goldman Sachs believes this will make KOSPI more reliant on foreign and institutional buying in the future, and October is a critical window to test whether foreign capital will continue to increase its investment in South Korean semiconductor and AI assets.

The cross-chain liquidity protocol ThorChain's official announcement states that the network interruption is an emergency security mechanism aimed at protecting the protocol's security. The suspension is not a selective freeze of specific funds, nor is it a targeted exchange against individuals.The announcement mentioned that in the security incident in May 2026, 10.7 million dollars were stolen from the liquidity pool. At that time, the attacker's address was not blacklisted, so it could still trade on ThorChain. ThorChain stated that it is a permissionless blockchain platform designed with the intention of not conducting any censorship.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

DyorSwap officially announced that the so-called "GIWA Mainnet" identified by the team earlier is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

DyorSwap officially announced that the so-called "GIWA mainnet" previously identified by the team is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

According to on-chain analyst Yu Jin's monitoring, over 90% of the funds exchanged across chains through THORChain are from illicit sources. Yu Jin stated that most of the stolen funds from Bybit last year were transferred via THORChain, which collected nearly 10 million dollars in fees within 10 days; recently, part of the stolen funds from Bitget has also been transferred through THORChain, with its fee income reaching 1 million dollars.

Recently, the Beijing Shijingshan police successfully intercepted a new type of cross-border telecom fraud case, freezing 780,000 yuan in involved funds and returning it to the victims. In this case, 53-year-old Mr. Liu received a fraudulent call from abroad while accompanying his child studying overseas. The scammer impersonated domestic police, fabricated false allegations of money laundering, and induced him to urgently request money transfers from his family in China.The funds were subsequently transferred into the accounts of two other Chinese students studying abroad. Upon investigation, it was found that these three individuals were all victims of the same fraud gang, exhibiting characteristics of "multiple scams in one case, with victims serving as money laundering tools for each other." The scammers first transferred funds into the accounts of some victims, then coerced them into exchanging for U currency to assist in the transfer, which was highly concealed and involved complex cross-border links. The police successfully "awakened" the victims through patient persuasion, preventing greater losses.

Bitget CEO Gracy Chen stated on the X platform that the Bitget bounty recovery program has been launched: a 5% reward for facilitating the freezing of the attackers' funds, and an additional 5% reward for successfully recovering the funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for their swift freezing actions.According to previous reports, Circle and Tether have frozen 218,023 USDT and 99,990 USDC in addresses related to the Bitget attack, totaling approximately $318,000. Bitget stated that the attack resulted in losses of about $351.6 million, with the attackers breaching the wallet service backend system, forging transfer information, and triggering the authorization signature process, ruling out private key leakage.

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

According to on-chain analyst tanuki42, the address 0xe07 holds 100,000 USDC and 218,000 USDT, which come from the initial address of stolen funds from Bitget. This batch of funds has been idle for over 2.5 hours, after which they publicly called on Circle and Tether to freeze the assets.At 5 PM, crypto researcher SomaXBT posted that Circle has frozen the USDC assets and specifically called on Tether to follow up. As of the time of publication, Tether has not responded.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

Bybit co-founder and CEO Ben Zhou stated that the Bybit team is ready to assist in various ways regarding the recent hacking incident involving Bitget. Previously, when Bybit faced a hacking attack, Bitget provided support.Ben Zhou mentioned that Bybit is currently updating the LazarusBounty platform to assist Bitget in tracking the relevant flow of funds.On February 21, 2025, Bybit experienced the largest hacking attack in cryptocurrency history at that time (approximately $1.46 billion to $1.5 billion worth of Ethereum was stolen, later attributed to the North Korean Lazarus group). After the attack, Bitget quickly transferred 40,000 ETH (approximately $10.5 million to $10.6 million at that time) to Bybit, with the funds coming from Bitget's own reserves, not user assets. This support was an interest-free, unsecured loan with no fixed repayment deadline, aimed at helping Bybit cope with withdrawal runs and replenish liquidity.

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

Bitget CEO Gracy Chen stated during a live broadcast regarding the platform's attack incident that some of the affected funds may have a chance of being recovered. Regarding the resumption of withdrawals, Gracy Chen mentioned that Bitget needs to first investigate the relevant issues thoroughly. The technical team is currently advancing system repairs and security enhancements. The platform will only reopen the withdrawal function after confirming the system's security and ensuring that resuming withdrawals will not lead to further attacks by hackers.She stated that once a clear time window for the resumption of withdrawals is established, users will be informed immediately and an announcement will be made. Currently, no specific time can be promised, as the platform does not wish to make commitments that cannot be fulfilled.

According to a report by The Information, Tether has some funds trapped at one of its offshore banking partners, which is facing liquidation risk after asset seizures in the United States.Tether stated that the assets it holds at the bank EQIBank are limited, accounting for less than 0.034% of its total assets.

According to CoinDesk, asset management company ARK Invest announced a partnership with tokenization platform Securitize to tokenize its ARK Venture Fund (ARKVX), initially issuing it on Ethereum, with potential expansion to other blockchains in the future. The fund invests in private and public companies, with holdings including OpenAI, Anthropic, Stripe, and Databricks. ARK founder and CEO Cathie Wood stated that bringing the ARK Venture Fund on-chain is a natural extension of its mission to democratize investment in disruptive innovation.Securitize CEO Carlos Domingo stated that this move provides investors with diversified exposure to popular private tech companies, allowing them to hold both OpenAI and Anthropic simultaneously if they are uncertain about which will win the AI race. He also noted that tokenization does not put these companies or their shares on-chain; instead, investors receive an on-chain representation of the fund's equity, while the underlying assets remain private, but user investments are liquid. Securitize also plans to provide daily net asset values and support on-chain market trading of fund equity.This collaboration builds on the existing relationship between the two parties, as ARK made a strategic investment in Securitize last year. Currently, Wall Street asset management companies are accelerating the introduction of traditional financial products to the blockchain, with early attempts like BlackRock's BUIDL and Franklin Templeton's BENJI fund primarily focused on U.S. Treasury and money market products, now expanding into stocks and private markets.

According to Bits.media, the Central Bank of Russia has amended the investment rules for mutual funds, allowing funds aimed at professional investors to invest in settlement indices linked to digital currency quotes.Retail mutual funds can also allocate a portion of non-listed Russian securities and foreign securities, including tokenized securities and shares of exchange-traded funds linked to cryptocurrency prices, with an investment limit of 10% for related assets and 20% for closed-end funds.

Market news indicates that Powerlaw is considering a strategic sale of part of its SpaceX shares to raise funds for dividends, tax distributions, and new private market investments.

Binance will gradually migrate the cryptocurrency assets in users' Funding Accounts to Spot Accounts starting from September 29, 2026. The migration is expected to continue until January 2027, with specific dates to be announced later.After the migration period ends, the Funding Account will be renamed to Stocks Account, which will only be used for trading and settlement of stocks and stock options.