ChainCatcher news, the on-chain analysis agency X-explore posted on social media stating that it believes the reason for the attack on Poloniex is the leakage of private keys, and the attackers are the Lazarus Group.It is reported that this attack is similar to the attack on Stake.com on September 4, 2023, where hackers stored different tokens in different addresses, with each address handling only one type of token.

According to ChainCatcher news and X-explore analysis, about 20.1% of the addresses that received the Celestia airdrop belong to the Big Witch Studio (which has 20 or more addresses), and 20.7% of the addresses belong to the Medium Witch Studio (which has 5 or more addresses). In addition, the Witch Studio that received the most airdrops holds a total of 300 airdrop addresses and has received 77,391 TIA.

ChainCatcher message, X-explore tweeted that some malicious browser extensions have replaced part of the users' deposit and withdrawal addresses on centralized exchanges (CEX) with hacker addresses. Since June 2022, there have been hundreds of attacks on Binance, Stake.com, Bitso, and more than 10 other CEXs, with 142 attacks on Ripple resulting in a loss of 14,361 XRP. (source link)

ChainCatcher news, according to data analysis by @x_explore_eth, in the past two days, users have lost another $1 million in funds on Ethereum due to zero U poisoning scams. A total of 265 users have been attacked by zero U, with cumulative losses of $4.3 million. (source link)

ChainCatcher news, according to X-explore analysis, as of 8 AM Beijing time on October 20, Binance has accumulated 28,000 users depositing over 16.3 million APT, among which market makers deposited 4.12 million APT, and deposits identified by X-explore as witch addresses account for nearly 40%, exceeding 6.3 million.In addition, there are more than 7 large witch gangs that have deposited over 50,000 APT. As time goes by, the total amount of deposits continues to decline, but the proportion of deposits from witch addresses to normal users remains basically unchanged, with witch users accounting for over 65% of the total deposits. (source link)