intermediary

Drift Protocol posted on platform X that the preliminary investigation into the attack on April 1, 2026, shows that the operation was orchestrated by the North Korean government-supported hacker group UNC4736 (also known as AppleJeus or Citrine Sleet). This organization has been interacting face-to-face with Drift contributors for six months since the fall of 2025, by sending intermediaries to attend cryptocurrency conferences and establishing fake quantitative trading companies, and inducing them to download malicious code repositories or applications. Currently, Drift has frozen all protocol functions and removed the compromised wallets from multi-signature. Mandiant has been invited to participate in a deep forensic investigation. The investigation confirms that the on-chain fund flows used to test the operation can be traced back to the Radiant Capital attackers in October 2024.

According to Arkham data, at 03:42, 1000 BTC (worth approximately $892 million) was transferred from one anonymous address (starting with 32YRAd...) to another anonymous address (starting with bc1qw0...).

According to Arkham data, at 06:15, 2499.99 BTC (worth approximately 235 million USD) was transferred from one anonymous address (starting with 3MCqoqz2...) to another anonymous address (starting with 38Jn5ZUB...). Subsequently, that address transferred a portion of the BTC (1910 BTC) to another anonymous address (starting with 3PX3LdJ5...).

According to Arkham data, at 06:02, 200 BTC (worth approximately $16,567,700) was transferred from an anonymous address (starting with bc1qja...) to another anonymous address (starting with bc1q58...). Subsequently, that address transferred a portion of the BTC (189 coins) to another anonymous address (starting with bc1qq0...).

According to Arkham data, at 17:17, 96,574.29 ETH (worth approximately 283 million USD) was transferred from one anonymous address (starting with 0x3083...) to another anonymous address (starting with 0x99E1...). Subsequently, at 17:18, that address transferred 3,425.62 ETH to another anonymous address (starting with 0x99E1...).

According to Arkham data, at 21:29, 399 BTC (worth approximately 25.27 million USD) was transferred from one anonymous address (starting with bc1ql4...) to another anonymous address (starting with bc1qhnh...). Subsequently, that address transferred a portion of the BTC (288.999958 BTC) to another anonymous address (starting with bc1qjm7...).

According to Arkham data, at 13:12, 524.85 BTC (worth approximately $48,399,300) was transferred from one anonymous address (starting with bc1qqevvj...) to another anonymous address (starting with bc1q45v6t...).

According to Bloomberg Law, the new guidelines from the Office of the Comptroller of the Currency (OCC) allow U.S. banks to provide intermediary services for cryptocurrency transactions, further clarifying how traditional lending institutions can legally participate in digital asset trading.The OCC memorandum states that banks can act as brokers, purchasing assets from one counterparty while selling those assets to another counterparty. In this process, lending institutions will not hold any crypto assets.

According to Arkham data, at 11:31, 200 BTC (worth approximately 17.91 million USD) were transferred from one anonymous address (starting with 17vnCHd1...) to another anonymous address (starting with bc1qur3t...).

According to Arkham data, at 12:44, 324.51 BTC (worth approximately 29.67 million USD) was transferred from one anonymous address (starting with bc1qyh6jj...) to another anonymous address (starting with bc1qammx0...). Subsequently, that address transferred 322.26 BTC to another anonymous address (starting with bc1q5q52j...).

According to Arkham data, at 14:57, 200 BTC (worth approximately 17.1 million USD) were transferred from one anonymous address (starting with 3Lhmv...) to another anonymous address (starting with 3FQv8...). Subsequently, that address transferred part of the BTC to another anonymous address (starting with bc1q8...).

ChainCatcher message, according to PeckShield monitoring, the address marked as ResupplyFi Exploiter 3 has transferred 1000 ETH (approximately 4.3 million USD) to an intermediary address and has begun laundering operations through Tornado Cash.

ChainCatcher message, on-chain data shows that 28,000 ETH was transferred from the Ceffu wallet to an unknown wallet. Subsequently, the unknown wallet address transferred 27,978 ETH (approximately 62 million USD) to the Binance exchange. Currently, the unknown wallet address still holds about 9,273 ETH, while the Ceffu wallet holds approximately 282,600 ETH (worth about 630 million USD).

ChainCatcher news, according to CoinDesk Japan, the Financial Services Agency of Japan approved the Financial Review Council's working group report on the payment settlement system on February 19. The report underwent seven rounds of discussions and proposes a new regulatory framework for cryptocurrency exchanges and stablecoins.The report suggests incorporating relevant provisions of the Financial Instruments and Exchange Act into the Payment Settlement Act to enhance user protection in the event of exchange bankruptcies. It also proposes the introduction of a "belonging system" for cryptocurrency trading, requiring intermediaries to be affiliated with specific exchanges and prohibiting them from holding user assets.Regarding stablecoin regulation, the report allows issuing institutions to allocate up to 50% of their assets to short-term government bonds and specific time deposits, no longer limited to demand deposits. This regulatory framework has been submitted for approval by Financial Services Agency official Katsunobu Kato, and the relevant legislative work is set to begin soon.

ChainCatcher message, Whale Alert monitoring, a few minutes ago, 36,200 ETH (approximately $102 million) was transferred from the Ceffu wallet to an unknown wallet. Subsequently, the unknown wallet address transferred 36,909 ETH (approximately $104 million) to Binance exchange.Currently, the unknown wallet address still holds about 9,130 ETH, while the Ceffu wallet holds approximately 347,000 ETH (worth about $970 million).

ChainCatcher news, according to Onchain Lens monitoring, one hour ago, DWF Labs deposited 1.68 million LIT into Binance through an intermediary wallet, approximately 1.46 million USD.Previously, it had transferred 1.4 million LIT worth 911,000 USD to Binance. DWF Labs no longer holds any LIT.

ChainCatcher news, according to @ai_9684xtpa's monitoring, a whale that purchased 387 bitcoins at an average price of $57,367 two weeks ago has recently been liquidating its holdings in batches, ultimately making a profit of about $990,000.The whale withdrew 387 bitcoins from Binance on August 7, and then reduced its holdings at two price points of $57,321 and $60,692. Finally, the remaining 205 bitcoins were recharged back to Binance through a transit address three hours ago, worth approximately $12.44 million.

ChainCatcher news, according to Solid Intel, the Genesis wallet transferred approximately 14,000 BTC (900 million USD) and 156,000 ETH (480 million USD) through a transit address in the last hour, suspected to be executing bankruptcy liquidation procedures.According to Arkham data, the Genesis Trading address currently holds approximately 14 million USD in crypto assets, of which only 229 ETH (worth 720,000 USD) and about 10 million USD in BTC.It is reported that the bankrupt crypto lending company Genesis received court approval in May this year to repay its creditors with billions of dollars in digital assets and cash.

ChainCatcher message, Arkham data shows that the German government bc1q0 address transferred 2500 BTC to the intermediary address bc1qq, with a current remaining holding of 15,552 BTC.Past data shows that each transfer to Coinbase is executed by the bc1qq address.