3月17日，Bitrefill正式披露了一次发生在3月1日的网络攻击，此次攻击手法与过往Lazarus Group / BlueNoroff针对其他加密资产行业公司的网络攻击有诸多相似之处。Beosin安全团队结合收集的威胁情报及Bitrefill公开的信息，对本次事件进行了攻击手法与资金追踪分析，并将结果分享如下：
攻击手法分析
据Bitrefill披露，本次攻击最初是通过入侵一名员工的笔记本电脑并从中窃取了旧版凭证，
钱包的访问权限：批量导出了 18,500 条订单数据，含用户邮箱、加密地址、IP；并伪造采购消耗礼品卡库存。
https://x.com/bitrefill/status/2033931580352221656
结合威胁情报和链上交易数据，Beosin通过旗下区块链链上调查与追踪平台Beosin Trace对Bitrefill相关损失资金进行了详尽的资金追踪，并将结果分享如下：
目前，Beosin锁定了3个疑似 Bitrefill 黑客事件的地址：
0x5a0128e21cb8dc515ab8c4e5079b1f0444e92763
0x3d79f9012a13fe7948daaee3b8e9118371450d69
TVfA8wz2quUvRvhqs8VtnCeMyV2VzFAW9R
其资金流向如下图所示：
被盗资金流向分析图 by Beosin Trace
其中地址0x5a0128e21cb8dc515ab8c4e5079b1f0444e92763将174 ETH转入了Tornado Cash中。针对Tornado Cash这类混币协议的资金追踪难度，Beosin依托多起混币洗钱案件的溯源经验，通过对全量充值、提取数据的持续监测，从交易时序、金额特征、行为模式等多维度关联分析，使用自研智能追踪算法实现了对本次混币资金链路的穿透，锁定了其出金地址：0x3d79f9012a13fe7948daaee3b8e9118371450d69。
随后该地址通过兑币跨链从ETH链跨到TRON链，并将179 ETH兑换为413,763.75 USDT。目前该地址TVfA8wz2quUvRvhqs8VtnCeMyV2VzFAW9R共有575,212.91 USDT沉淀。
以上地址均已被Beosin KYT标记为高风险地址，以地址为例：
Beosin KYT
Crypto influencer SolJakey has disclosed that he was forced to flee the country due to death threats following the controversial launch of the $LIBRA token.
CatherineStrive Asset Management suggested GameStop invest its $4.6 billion in Bitcoin to become a key player in digital assets. GameStop has not yet responded but is reportedly exploring alternative assets.
Weatherly21 D.O.G.E. employees resigned, warning that Musk's government purge is destabilising federal systems and threatening vital public services. After political loyalty interrogations, one-third of the agency was dismissed overnight via an anonymous email. The purge has disrupted essential services like Social Security, disaster relief, and taxes. Could this bold move backfire and harm the very institutions it seeks to reform?
KikyoApple announced a $500 billion investment in its U.S. operations, focusing on AI, manufacturing, and engineering. Despite speculation, the company has not shown any interest in adopting cryptocurrency.
WeatherlyA viral video captures a startling moment as two AI agents recognise each other during a call—then abruptly switch from human language to an unknown, machine-only communication.
CatherineA Binance user was targeted by a phishing scam after receiving a fake SMS about account access from North Korea. The scammer convinced the user to transfer funds to a fraudulent wallet, resulting in a financial loss.
WeatherlyCircle's CEO, Jeremy Allaire, is calling for mandatory registration of stablecoin issuers in the U.S. to ensure transparency and protect consumers. Meanwhile, U.S. lawmakers and regulators are intensifying efforts to create clear rules for stablecoins, with growing scrutiny on companies like Circle and Tether.
AnaisPump.fun’s X account was hacked to promote a fake PUMP token, which quickly collapsed, leaving victims with worthless assets. The platform regained control and urged users to verify information. Yet many still fell for the scam despite prior warnings—was it blind optimism or greed?
CatherineThe SEC, Tron Foundation, and Justin Sun have asked a federal court to pause the 2023 lawsuit to explore a resolution. The case involves allegations of unregistered TRX and BTT sales, market manipulation, and undisclosed celebrity endorsements.
KikyoBank of America plans to launch a USD-backed stablecoin once US lawmakers approve the regulatory framework. The move could bring stablecoins into mainstream consumer banking, increasing competition among major financial institutions.
Weatherly