BTC $75,214.97 +0.74%
ETH $2,130.65 -0.03%
BNB $691.01 +0.87%
XRP $1.10 -1.68%
SOL $86.57 -0.80%
TRX $0.3175 -0.53%
DOGE $0.0699 +0.79%
ADA $0.1771 +0.45%
BCH $238.57 -0.28%
LINK $10.64 +1.62%
HYPE $75.11 -0.24%
AAVE $131.88 +3.66%
SUI $0.8441 +2.58%
XLM $0.1472 +0.08%
ZEC $1,166.80 -4.85%
AAPL $350.68 +2.03%
AMZN $268.55 +3.46%
GOOGL $291.14 +2.68%
MSFT $545.16 +2.32%
META $643.57 +5.32%
NVDA $181.32 +0.30%
TSLA $378.95 +6.31%
SNDK $898.86 +10.40%
INTC $59.84 +7.84%
SPCX $142.41 +5.03%
MU $736.96 +10.39%
AMD $513.60 +14.57%
BTC $75,214.97 +0.74%
ETH $2,130.65 -0.03%
BNB $691.01 +0.87%
XRP $1.10 -1.68%
SOL $86.57 -0.80%
TRX $0.3175 -0.53%
DOGE $0.0699 +0.79%
ADA $0.1771 +0.45%
BCH $238.57 -0.28%
LINK $10.64 +1.62%
HYPE $75.11 -0.24%
AAVE $131.88 +3.66%
SUI $0.8441 +2.58%
XLM $0.1472 +0.08%
ZEC $1,166.80 -4.85%
AAPL $350.68 +2.03%
AMZN $268.55 +3.46%
GOOGL $291.14 +2.68%
MSFT $545.16 +2.32%
META $643.57 +5.32%
NVDA $181.32 +0.30%
TSLA $378.95 +6.31%
SNDK $898.86 +10.40%
INTC $59.84 +7.84%
SPCX $142.41 +5.03%
MU $736.96 +10.39%
AMD $513.60 +14.57%

idg

All
Article
Flash

Analysis: Suspected North Korean hackers transferred approximately 1.46 million USD through the cross-chain bridge between Jupiter Lend and Circle, with Jupiter stating that the source of the funds has not been cut off

On-chain analyst @FabianoSolana posted that suspected North Korean hackers transferred approximately $1.46 million through the Jupiter Lend and Circle cross-chain bridge. According to his analysis, the funds were initially transferred from a Solana wallet address marked by the FBI (starting with AffzFD), then dispersed to about 35 temporary addresses via intermediary wallets before being re-aggregated and deposited into Jupiter Lend. A few minutes later, a similar amount was withdrawn by another new wallet.Subsequently, the funds were exchanged for USDC and transferred out of Solana through the Circle cross-chain bridge, returning to a new address on the Solana network via Noble and dYdX. The related funds were transferred out in approximately 16 transactions totaling about $1.4634 million, and then returned in 19 transactions, with a difference of about $10 between the amounts transferred out and returned. According to the analyst, the related funds have not been frozen.In response, Jupiter's Chief Operating Officer Kash Dhanda stated that based on the current investigation results, the attackers only performed deposit and withdrawal operations through Jupiter Lend, which is different from the previous Aave incident where stolen stablecoins were borrowed and could not freeze the assets. The flow of related funds can still be fully tracked through LP tokens, and the relationship of the funds has not been severed, so it cannot be concluded that the attackers used Jupiter Lend to launder the source of the funds. The Jupiter security team has been monitoring the flow of related funds in real-time. As of the time of publication, Circle has not publicly responded to the reasons for the aforementioned fund transfer and why they have not been frozen.

first_img Israel extradites the suspect of the Nomad cross-chain bridge attack to the United States

According to Decrypt, the Israeli National Prosecutor's Office announced on Thursday that it has extradited Alexander Block, who holds dual citizenship in Israel and Russia (formerly known as Alexander Gurevich), to the United States. He is accused of stealing approximately $2.8 million in assets from the cross-chain bridge Nomad in 2022.Block was handed over to the U.S. authorities early that morning after failing multiple appeals in Israel. He was arrested at Tel Aviv's Ben Gurion Airport in May 2025 while preparing to fly to Russia, shortly after changing his surname and obtaining a passport under his new name.According to the U.S. extradition request disclosed in the Israeli Supreme Court ruling, a federal grand jury in the Northern District of California had indicted Block in August 2023 on four counts of computer fraud, one count of transporting stolen property, and three counts of money laundering. The U.S. formally submitted the extradition request in December 2024.Prosecutors stated that a vulnerability was left in the Nomad smart contract after a software update in June 2022, allowing users to obtain tokens on one chain without locking equivalent assets on another chain. Block, using the username "Bitlik," first conducted six test transfers and then completed four major transfers around August 1, 2022, acquiring tokens worth over $2.8 million, which he transferred through multiple wallets and exchanged for other cryptocurrencies to conceal the source of the funds.The U.S. allegations claim that his actions exposed the vulnerability, leading other users to withdraw nearly all of the over $186 million in user funds controlled by Nomad's wallet. Days later, Block returned some tokens and contacted Nomad executives via Telegram, proposing to return the remaining assets in exchange for a bounty for the vulnerability, but then cut off communication, prompting Nomad to report to U.S. law enforcement. Block argued that the transactions utilized features provided by Nomad's automated system and that on-chain transfers are publicly visible, thus not constituting money laundering.The Israeli Supreme Court rejected both claims, ruling that even if the software technically allowed the operation, exploiting a programming vulnerability could still constitute illegal intrusion into a computer system, and publicly visible transactions do not necessarily identify the actual controller behind the wallets.In December 2025, the U.S. Federal Trade Commission proposed a settlement regarding Nomad's operator Illusory Systems, stating that the cross-chain bridge lost $186 million due to insufficiently tested software updates, and the settlement required it to return recovered funds to users who had not yet been compensated; Nomad recovered approximately $22 million within days after the attack.
app_icon
ChainCatcher Building the Web3 world with innovations.