Suspected North Korean hackers moved about $1.46 million through Jupiter Lend and Circle’s cross-chain bridge, according to on-chain analyst @FabianoSolana. Funds from an FBI-flagged Solana wallet were routed through roughly 35 intermediary wallets, deposited into Jupiter Lend, then withdrawn by a new wallet minutes later.
Why it matters
The transfers included 16 outbound transactions totaling $1,463,410 and 19 inbound transfers totaling $1,463,400. The funds were swapped into USDC, bridged through Noble and dYdX, then returned to Solana. None were frozen.
Jupiter COO Kash Dhanda said the attackers deposited and withdrew through Jupiter Lend, without borrowing against the funds as in an earlier Aave incident. He said LP tokens preserved wallet associations and Jupiter’s security team monitored the activity in real time.
Market impact
The episode puts attention on how lending protocols and cross-chain routes handle suspected stolen funds. Jupiter says the assets remain traceable, but Circle had not publicly addressed the transfers or explained why they were not frozen as of publication.
Frequently asked questions
-
How did the funds move through Jupiter Lend?
Funds from an FBI-flagged Solana wallet passed through roughly 35 intermediary wallets, were deposited into Jupiter Lend, then withdrawn by a new wallet minutes later.
-
How much money did the reported transfers involve?
The analyst reported 16 outbound transfers totaling $1,463,410 and 19 inbound transfers totaling $1,463,400.
-
Which routes did the funds take after leaving Jupiter Lend?
The funds were swapped into USDC, bridged through Noble and dYdX, and returned to Solana.
-
Why does Jupiter say the funds remain traceable?
Jupiter COO Kash Dhanda said LP tokens preserved wallet associations, allowing the funds to be traced.
-
Did Jupiter or Circle freeze the funds?
No funds were frozen. Jupiter said its security team monitored the activity in real time, while Circle had not publicly addressed the transfers as of publication.
WuBlockchain