ChainCatcher message, SlowMist tweeted that the attackers of CoinsPaid, Atomic, and Alphapo may all be part of the North Korean hacker group Lazarus Group.SlowMist stated that the address starting with TGGMvM received nearly 120 million TRX transferred from the address starting with TJF7md related to the Alphapo incident, and the TGGMvM starting address also received funds from the Coinspaid hot wallet through addresses starting with TNMW5i and TJ6k7a on July 22. The address starting with TNMW5i had previously received funds from the address used by the Atomic attacker. (Source link)

ChainCatcher news, on-chain analyst ZachXBT updated that "another $37 million stolen from Alphapo has been discovered on Tron and Bitcoin, bringing the total amount stolen from Alphapo to $60 million. This hack is likely carried out by Lazarus."Previously, on July 23, ZachXBT tweeted that the hot wallet of cryptocurrency payment provider Alphapo was hacked, resulting in losses of over $23 million in assets including Ethereum, Tron, and Bitcoin. ZachXBT stated that Alphapo provides payment services for some gambling platforms. (source link)

ChainCatcher message, the blockchain security agency Hacken tweeted that of the 23 million dollars stolen from the Alphapo hot wallet, 11 million dollars were bridged to BTC via the Avalanche Bridge, while the remaining funds are still at the attacker addresses starting with "0x040a" and "TJF7md".The stolen assets include: 100.2 million FTN, 6 million USDT, 2500 ETH, 108,000 USDC, 118 million TRX, 430,000 TFL, and 1700 DAI.

ChainCatcher message, according to monitoring by ZachXBT, the Alphapo hot wallet was hacked, with stolen funds exceeding 23 million dollars.It is reported that Alphapo client HypeDrop has disabled the withdrawal feature. The stolen funds were first cross-chained to Ethereum, and then cross-chained to Avalanche and BTC networks. (source link)