North Korea-linked hackers may be behind the theft of $24 million from a bridge run by AFX, a decentralized crypto exchange. If confirmed, the attack would connect the same group to about $316 million stolen in just over three months.
- ZeroShadow, a blockchain intel firm, said in an X post on July 24 that the AFX bridge exploit was "highly likely linked" to UNC4899, a North Korean hacking unit also known as TraderTraitor.
- Working with SEAL, a non-profit coalition that helps crypto projects respond to attacks, the firm said it traced a connection between ETH used to pay transaction fees for the AFX bridge theft and similar funding behind an earlier KelpDAO exploit.
- However, zeroShadow didn't publish the complete wallet trail or all the indicators supporting its conclusion.
Another alleged TraderTraitor attack
KelpDAO, a crypto staking service, lost 116,500 rsETH, a token representing deposited ETH, worth about $292 million on April 18.
- A report from LayerZero Labs, the company behind the cross-chain messaging system used by KelpDAO's bridge, said Mandiant and CrowdStrike, two cybersecurity firms, attributed that attack to TraderTraitor.
- The AFX theft would therefore represent another $24 million allegedly taken by the group.