Jupiter Says Suspected North Korean Hackers’ $1.46M Transfers Remain Traceable After Cross-Chain Moves

Suspected North Korean hackers transferred about $1.46 million through Jupiter Lend and Circle’s cross-chain bridge, while Jupiter said the funds’ origins remained traceable. According to ChainCatcher, on-chain analyst @FabianoSolana said the funds initially left an FBI-flagged Solana wallet beginning with AffzFD, passed through intermediary wallets to about 35 temporary addresses, then were consolidated and deposited into Jupiter Lend. Minutes later, a new wallet withdrew a similar amount. The funds were then converted to USDC and moved from Solana through Circle’s cross-chain bridge, passing through Noble and dYdX before returning to a new Solana address. Across 16 transactions, about $1.4634 million was transferred out, then returned through 19 transactions; the amounts differed by about $10. The analyst said the funds had not been frozen. Jupiter Chief Operating Officer Kash Dhanda said the investigation so far showed that the attacker only deposited and withdrew funds through Jupiter Lend. Unlike the earlier Aave incident, in which stolen stablecoins were used to borrow assets that could not be frozen, the funds’ movements remain fully traceable through LP tokens, Dhanda said. He said the attacker therefore had not used Jupiter Lend to conceal the funds’ origins, and that Jupiter’s security team was monitoring the flows in real time. Circle had not publicly commented on the transfer or why the funds were not frozen as of publication.