Analyst Traces $1.46M in Suspected North Korea-Linked Funds Through Jupiter

On-chain analyst @FabianoSolana described a route moving about $1.46 million linked to suspected North Korean hackers through Jupiter Lend and Circle’s bridge; Jupiter’s chief operating officer said the transfers remained traceable.

The analyst said the funds started in a Solana wallet beginning AffzFD that the FBI had flagged. They moved through intermediary wallets, were split among about 35 temporary addresses, then brought together and deposited in Jupiter Lend. A different new wallet withdrew a similar amount minutes later.

The funds were converted to USDC, moved off Solana through Circle’s cross-chain bridge, routed through Noble and dYdX, and sent to a new Solana address. About $1.4634 million left in 16 transactions, while a similar amount returned in 19; the amounts differed by about $10. The analyst said the funds had not been frozen.

Jupiter Chief Operating Officer Kash Dhanda said the investigation so far showed the actor used Jupiter Lend only for deposits and withdrawals. He said LP tokens kept the movement traceable and maintained its link to the original funds, so Jupiter did not view the use of its service as laundering. Dhanda said Jupiter’s security team was monitoring the movement in real time.