Analyst: Suspected North Korean Hackers Moved $1.46M via Jupiter Lend and Circle Bridge; Jupiter Says Funds Remain Traceable

On-chain analyst @FabianoSolana reported that suspected North Korean hackers moved approximately $1.46 million through Jupiter Lend and Circle’s cross-chain bridge. Funds from an FBI-flagged Solana wallet (AffzFD) were routed through roughly 35 intermediary wallets, consolidated, and deposited into Jupiter Lend before a new wallet withdrew a similar amount minutes later. The funds were then swapped into USDC, bridged through Noble and dYdX, and returned to Solana. The analyst reported 16 outbound transfers totaling $1,463,410 and 19 inbound transfers totaling $1,463,400, with no funds frozen.Jupiter COO Kash Dhanda clarified that the attackers only deposited and withdrew funds through Jupiter Lend, unlike an earlier Aave incident involving borrowing non-freezable assets against stolen stablecoins. He said the funds remained fully traceable through LP tokens, with wallet associations preserved, and that Jupiter’s security team monitored the activity in real time. As of publication, Circle had not publicly addressed the transfers or explained why the funds were not frozen.