BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
显示更多
Bitget CEO:3.5 亿美金被盗很可能与朝鲜黑客有关
9 月 24 日,Bitget 发现多个热钱包出现未经授权的资金转出。Bitget CEO Gracy Chen
@GracyBitget 表示,团队识别出部分 IP 地址,其 VPN 使用特征与某个 DPRK 相关组织此前的活动相吻合,因此认为此次攻击“很可能”与朝鲜黑客有关。她还表示,攻击者并未获取 Bitget 热钱包、温钱包或冷钱包的私钥,而是攻破了交易所内部系统,并直接从系统中转移资金。
Bitget 此前表示,其用户保护基金规模已超过 4.64 亿美元,公司称该基金足以覆盖此次损失。
来源:Bitget
显示更多
President Xi Jinping met with Pak Thae Song, Member of the Presidium of the Political Bureau of the Central Committee of the Workers’ Party of Korea, Vice President of the State Affairs Commission of the Democratic People’s Republic of Korea (DPRK) and Premier of the Cabinet. Premier Pak Thae Song is on an official visit to China.
President Xi stressed that the current international landscape is fraught with changes and turbulence. Both China and the DPRK should maintain firm strategic resolve, enhance strategic confidence, accelerate the implementation of the consensus reached between me and General Secretary Kim Jong Un, and ensure that the relations between our two parties and countries keep pace with the times and continue to develop in a direction that serves our respective socialist cause and modernization.
显示更多
Xi Jinping, general secretary of the Communist Party of China Central Committee and Chinese president, arrived in Pyongyang on Monday for a state visit to the Democratic People's Republic of Korea (DPRK).
显示更多
Xi arrives to grand welcome in Pyongyang for state visit to DPRK
The DPRK held a grand welcome ceremony at Kim Il Sung Square for Xi Jinping, general secretary of the Communist Party of China Central Committee and Chinese president, who arrived in Pyongyang on Monday for a state visit.
显示更多
Xi Jinping, general secretary of the Communist Party of China Central Committee and Chinese president, was warmly welcomed in Pyongyang on Monday as he arrived for a state visit to the DPRK.
显示更多
🇺🇸🇯🇵🇰🇷⚔️🇨🇳🇰🇵🧵 HOW THE UNITED STATES TURNED JAPAN AND SOUTH KOREA INTO IMPERIAL COLONIES AS PART OF ITS COLD WAR AGAINST CHINA AND THE DPRK
American policy in the Asia-Pacific has always been centered in building up Japan’s industry and leveraging Tokyo’s power at the expense of the economic independence of other country’s in the region. This doctrine goes all the way back to the early 20th century as Theodore Roosevelt committed the United States to the establishment of a global empire and JP Morgan created a monopoly over large sectors of the American economy in the aftermath of the Panic of 1907.
The Meiji Restoration, which established the Empire of Japan, brought industrialization and modernization to the Japanese economy. However, this was mostly done on the backs of foreign loans and had been a continuation of work already theorized in China under Sun Yat Sen, whose Three Principles (Nationalism, Democracy, People’s Livelihood) inspire Chinese socialism today and were based on the state-led economic frameworks of Alexander Hamilton and Abraham Lincoln. Sun himself was educated in Hawaii by protégés of Lincoln.
And it ultimately led to this notion among leaders in Tokyo that Japan is now becoming a partner of the Anglo-American Empire. A major reason why this was is because Theodore Roosevelt agreed in the Taft-Katsura Agreement that the United States would give Japan control over the Korean Peninsula if they did not interfere with Washington’s violent seizure of the Philippines. However, what Tokyo didn’t notice at first is that they were not becoming a regional empire but a proxy of American imperialism.
From there, the groundwork was set for Japan’s wars of mass genocide against the people of China, Korea, Russia and across the Asian continent. After its war with Russia in 1905, Tokyo fully annexed Korea in 1910, which would then be used as a launching pad for their wars against China. The Japanese previously launched a failed war against China in 1894, after which European colonial empires set up spheres of influence as part of the Century of Humiliation.
And then in 1931 and 1937, as a result of false flag incidents staged by the Japanese Kwantung Army along the South Manchuria Railway in Mukden and the Marco Polo Bridge near Beijing, Japan launched the Asia-Pacific Theatre of World War II waging mass genocide and engaging in sexual exploitation against the people of China, Korea and across Asia. Unit 731 was established in Manchuria under the command of Dr. Shiro Ishii and with the approval of the puppet dictatorship in Japanese-occupied Manchuria led by former Emperor of the Qing Dynasty Puyi.
731 carried out some of the most cruel and tortuous human experimentations against civilian victims, including infecting prisoners with deadly diseases and amputating their limbs, conducting vivisection and organ harvesting, suffocating victims and hypobaric chambers and exposing prisoners to chemical, explosive and biological weapons. Even more outrageous is the fact that Ishii escaped prosecution after the US granted him immunity in exchange for research from Unit 731. And some of that research was used by the CIA for Project MKUltra.
显示更多
Big News! 📣
@Ripple is now contributing high-confidence DPRK threat data through Crypto ISAC helping security teams move from awareness to action.
The reality is North Korean threat actors aren’t just attacking crypto, they’re infiltrating it.
The latest wave of attacks is shifting away from traditional exploits and toward something harder to detect: trusted access gained through social engineering, recruitment, and long-term deception.
In our new blog with Ripple, we break down:
- How these campaigns operate “from the inside out”
- Why traditional indicators aren’t enough to catch them
- And how shared, enriched threat intelligence is changing the equation
Because in this environment, no single company can see the full picture alone.
Read more 👇
#
CryptoSecurity# #
ThreatIntelligence# #
DPRK# #
Cybersecurity# #
DigitalAssets# #
CryptoISAC#
显示更多
关于 Arbitrum / KelpDAO 冻结资产被 DPRK 判决债权人盯上这件事。
太长不看:
1. DPRK judgment creditors 已经启动纽约判决执行程序,并取得法院批准替代送达。当前效果只是先锁住资产,法院没有判定这笔 ETH 最终归谁。
2. Arbitrum / Security Council 现在不能安全地绕开法院,短期内要把 ETH 转给 Kelp recovery 的可能性非常低。
3. Kelp-side 的强论点:如果这批 ETH 是被盗资产的可追踪 proceeds,DPRK / Lazarus 作为 thief 通常没有 good title。
4. Kelp-side 的最大风险:tracing、ownership、standing、recovery mechanism 证明是一个技术活。
所以...用户要做好“持久战”的心理准备,哪怕 Defiunited 再募捐到额外 30,000 ETH 替代 Arbitrum 这笔冻结,直接对用户进行赔付可能会让这个问题在未来愈发的复杂。
如果还有没走的用户建议早点走uniswap撤离吧:
卖出 aArbWETH 直接换 WETH,磨损只有0.05%-0.2%,大额可能要twap慢慢换,小额随时都能走。
Pool: aArbWETH <-> WETH
--- 以下是正文 ---
纽约州南区法院的法庭判令的原始文件:
当前情况在大部分web3用户眼里就是“DPRK 受害人律师要抢 Kelp/AAVE用户的钱”;不过从法律程序看,情况更复杂。
目前发生的链条大致是:
4月19日,Kelp / rsETH 相关资产遭遇攻击,攻击者被认为与 DPRK / Lazarus 有关。大约 36,167 rsETH 被跨链到 Arbitrum 上,并存入 AAVE 借出 ETH 和 wstETH,最终全部兑换为 30,766 ETH。
4 月 21 日,Arbitrum Security Council 紧急冻结了攻击者地址的 ETH。
4 月 30 日,DPRK 受害人一方的律师启动纽约判决执行程序,向 Arbitrum DAO 发出 **CPLR § 5222 restraining notice**,并请求法院批准替代送达。
5 月 1 日,S.D.N.Y. 法院批准了替代送达。也就是说,可以通过 Arbitrum governance forum、Security Council 成员、相关实体和律师等渠道,把 restraining notice 和 writs of execution 送达到 Arbitrum DAO 相关方。
5 月 2 日左右,相关 notice 被贴到 Arbitrum governance forum。
所以现在的状态是:这批资产已经进入一个正式的 judgment enforcement 程序。它不只是普通律师函,也不是 DAO 社区可以无视的治理争议。当然这一步也没有等于法院已经判定 DPRK 受害人可以拿走钱。
当前状况是:在法院进一步处理前,Arbitrum DAO / Security Council 不应擅自转移、释放或处分这批被主张为 DPRK / Lazarus 相关的资产。
这一点对 Arbitrum 很关键。
如果 Security Council 或 DAO 在 restraining notice 没有被解除、修改,或者没有拿到 court order 的情况下直接把资产转给 Kelp recovery wallet,法律风险会非常大。即使 Kelp-side 最后在实体权利上有理,Arbitrum 也可能因为违反 restraining notice 被追究责任。
所以最可能的路径是走完法院程序,再动资产:
Arbitrum / Kelp-side 进入法院程序,提出 defenses,主张 adverse claim,要求法院确认 DPRK 对这批资产没有可执行的 property interest,或者请求法院批准一个 court-supervised recovery plan。
接下来时间上可能会有几个节点:
第一,短期内可能会出现 emergency briefing 或 hearing。
如果 Arbitrum、Kelp 或其他受影响方主动出庭,法院可能会先处理一个很实际的问题:资产能不能继续冻结、能不能进入 escrow、能不能允许某种受控 recovery plan。
第二,如果双方只争“先不要动资产”,这个问题可能比较快进入法院视野。
但如果争的是最终 ownership / priority,也就是谁有权拿走这批 ETH,时间可能会明显拉长。
第三,CPLR § 5222 对第三方 garnishee 的 restraining notice 通常有一个很重要的时间维度:对第三方来说,restraining effect 一般可以持续到送达后一年,或者 judgment 被 satisfied / vacated,以较早者为准。 所以如果法院没有更早修改或解除 restraint,理论上这类冻结可能拖到接近一年。当然,实际中如果各方快速出庭、证据清楚,也可能更早解决。
这对 Kelp / AAVE 用户的影响很直接:
1. 短期内,Arbitrum 冻结的这部分 ETH 很难被用于kelp recovery处置。 资产技术上被冻结,法律上也被 restraining notice 锁住。即使 DAO 社区支持归还,也需要解决法院程序问题。
2. 中期看,用户能否尽快恢复损失,有不少争议问题需要明确:
🤔 frozen ETH 和 Kelp exploit 的链上路径是否足够清楚;
🤔这批 ETH 是原始被盗资产、直接 proceeds,还是经过 swap / bridge / conversion 后的混合资产;
🤔谁有资格代表受害人出庭主张权利;
🤔recovery wallet 或 claims process 是否能被法院接受;
🤔Arbitrum DAO / Security Council 在法律上到底是 custodian、controller,还是只是有技术 freeze / unfreeze 能力的治理主体。
当然,个人觉得Kelp-side 的实体论点其实还可以:如果这批 frozen assets 能被证明是 Kelp / rsETH exploit 中被盗资产的可追踪 proceeds,那么 DPRK / Lazarus 只是 thief。一般法律原则下,thief does not get good title。小偷偷来的东西,通常不会因为经过钱包、桥或 DEX,就变成可以拿来偿还小偷旧债的合法财产。
这也是 DPRK judgment creditors 最需要跨过的门槛:他们只能执行 DPRK 的 property interest,不能执行本来属于第三方受害人的财产。
但 Kelp-side 最大的挑战也在这里。
法院不会只听一句“这是 Kelp 用户的钱”。法院会看 tracing、ownership、standing 和 recovery mechanism。 如果链上路径不够干净,或者资产经过多次转换后已经很难证明是特定受害人的 property / proceeds,DPRK judgment creditors 的策略就会变强。他们会说,这些资产现在已经是 DPRK / Lazarus 控制下的 proceeds,因此可以用于执行旧判决。(当然我是觉得链路还算干净,唯一复杂的就是通过AAVE抵押套了一层借贷关系)
以上均非法律意见,只是基于公开材料的程序性分析。
显示更多