Analyst says suspected North Korean hackers moved $1.46 million through Jupiter Lend and Circle bridge

On-chain analyst @FabianoSolana said suspected North Korean hackers moved about $1.46 million through Jupiter Lend and Circle’s cross-chain bridge.

Funds moved out of an FBI-tagged Solana wallet

According to the analyst, the funds initially left an FBI-tagged Solana wallet address beginning with AffzFD. They were sent to an intermediary wallet, split across roughly 35 temporary addresses, then reconsolidated and deposited into Jupiter Lend.

Minutes later, another newly created wallet withdrew a similar amount from Jupiter Lend. The funds were then converted into USDC and bridged out of Solana through Circle. After moving through Noble and dYdX, they returned to a new address on the Solana network.

Outbound and returned amounts were nearly identical

The analyst said about $1.4634 million was transferred out in 16 transactions and then sent back in 19 transactions. The difference between the outbound and returned amounts was about $10. According to the analyst, the funds were not frozen.

Jupiter says wallet links remain traceable

Jupiter Chief Operating Officer Kash Dhanda said that, based on the investigation so far, the attacker only used Jupiter Lend for deposit and withdrawal activity. He contrasted that with the earlier Aave case, where stolen stablecoins were used to borrow assets that could not be frozen.

Dhanda said the movement of funds can still be fully tracked through LP tokens, and the relationships between the wallets have not been severed. In his view, that means the attacker cannot be said to have cleaned the origin of the funds through Jupiter Lend. Jupiter’s security team has been monitoring the movement of the funds in real time.

As of publication, Circle had not publicly responded to the transfers or to the reason the funds had not been frozen.