ChainCatcher news, the South Korean police have confirmed for the first time that the 342,000 Ethereum stolen from the cryptocurrency exchange Upbit in 2019 was carried out by the North Korean reconnaissance agency's hacker groups "Lazarus" and "Andariel." The police reached this conclusion through evidence obtained from North Korean IP addresses, the flow of cryptocurrency assets, and cooperation with the FBI.Among them, 57% of the Ethereum was exchanged for Bitcoin at a low price, while the remaining assets were laundered through 51 overseas exchanges. After four years of tracking, the police successfully recovered 4.8 Bitcoin (approximately 600 million Korean Won) from a Swiss exchange and returned it to Upbit.

ChainCatcher news, according to PeckShield monitoring, the address of the attacker exploiting the Polter Finance vulnerability has transferred a total of 2,625.7 Ethereum (ETH) to the privacy trading protocol Tornado Cash.

ChainCatcher message, PeckShield monitoring shows that the Polter Finance hacker has transferred 120 ETH to Tornado Cash. Polter Finance suffered a loss of approximately 8.7 million dollars in cryptocurrency assets.

ChainCatcher message, DEXX official stated on social media: "Currently, some users have reported that certain tokens are suspected to be dumped by hackers. We are analyzing the time and whether the addresses belong to our users. If you find any unusual token activity in your address or suspect that hackers are consolidating or selling tokens, please contact us immediately in the Telegram channel/contact a security company."

ChainCatcher news, the lending project polterfinance on the Fantom chain has left a message on-chain to the hacker stating: "If the funds can be returned in a timely manner, we are willing to negotiate and will not take legal action. Please send the funds to the corresponding address on the Fantom chain (starting with 0x6cA0). For further communication, please reply to this message."Previous report, polterfinance reported that it was attacked on the Fantom chain, with over $7 million in crypto assets stolen. The attacker initially obtained the funds on Ethereum through Tornado Cash, and the funds were later bridged to Fantom.The team has immediately taken the following actions: the platform has been suspended to control the vulnerability; the involved wallets have been traced to Binance; an active investigation into the vulnerability is underway.

ChainCatcher message, the DEXX official stated on social media, "Regarding the DEXX asset theft incident, the team has made some progress internally and is applying through legal channels to mark the hacker's wallet address. We are in the process of marking the hacker's address and requesting assistance from the Solana Foundation.Once marked, the hacker will not be able to deposit into any trading platform or exchange for fiat currency through any means. We are currently collaborating with multiple security agencies to trace the hacker's information and have filed cases in several locations. We will synchronize any publicly available information on X/Telegram."

ChainCatcher message, DEXX has posted on platform X addressing the hacker, stating that it has received strong support from security agencies, partners, and exchanges to locate the stolen tokens. They are also continuously monitoring the hacker's address to timely freeze the stolen funds and are now requesting that this incident be resolved within the next 24 hours, or they will take any further action.DEXX stated that it requires the hacker to contact them via email to return the stolen funds and will offer a bounty for vulnerabilities and token gifts. Once the funds are returned, all information currently held about the hacker will be immediately destroyed, and all subsequent tracking and analysis will cease, with the hacker no longer bearing responsibility. However, if the hacker does not comply with this agreement, DEXX will continue to cooperate with local police, security agencies, and exchanges to investigate and take law enforcement action to protect user assets, regardless of how long it takes.

ChainCatcher news, Beosin Alert posted on platform X, currently has collected about 2800 DEXX victim addresses, with over 9000 stolen transactions. An analysis of some stolen addresses' funds revealed that the stolen funds are still held in the hacker's address and have not been transferred out. It is likely the work of the same hacker, who is speculated to transfer funds based on the victims' token balances and arranged them in descending order of value.

ChainCatcher message, DEXX official announced the latest progress on the theft incident:The team has communicated with law enforcement agencies in multiple locations to file a case;They hope to communicate with the hacker;The SlowMist team has been engaged to investigate and account for all users' lost funds, as well as the flow of the hacker's funds;They are discussing follow-up solutions for users.Further updates will be promptly communicated through in-site notifications and X/Telegram.

ChainCatcher message, Slow Mist stated on platform X that, according to data submitted by community users, the losses from the DEXX hacking incident have reached millions of dollars, and these funds are currently scattered across multiple different hacker addresses.

According to ChainCatcher news reported by Cointelegraph, North Korean hackers appear to have developed malware that can evade Apple's security checks. Researchers at Jamf Threat Labs, who focus on Apple, indicate that these applications seem to be experimental. This is the first time they have seen such technology used to infiltrate Apple's macOS operating system, but it does not run on the latest systems.Researchers found that Microsoft's VirusTotal online scanning service reported these applications as harmless, but they are actually malicious. Variants of these applications are written in Go and Python, utilizing Google Flutter applications. Flutter is an open-source development toolkit used for creating cross-platform applications.Out of six malicious applications, five are signed with developer accounts and have been temporarily notarized by Apple. Researchers wrote, "The domains and techniques in the malware are very similar to those used in other North Korean hacker malware, with indications that the malware was once signed and even temporarily passed Apple's notarization process."

ChainCatcher news, the hacker Robert Powell, suspected of stealing $400 million in cryptocurrency from the FTX exchange through SIM card swapping, has applied to the court for a temporary lift of his house arrest to attend his girlfriend's sister's birthday party at Chuck E. Cheese in Illinois this Sunday.Powell was arrested in February this year along with two accomplices and was released under house arrest on a $10,000 bail, with restrictions on internet use, only allowing attendance at court or medical appointments. His lawyer stated that Powell has fully complied with all release conditions, and both the prosecution and pretrial services do not oppose this request.

ChainCatcher news, according to Cointelegraph, based on a report from SentinelLabs, North Korean hackers known as BlueNoroff are using new malware to attack cryptocurrency companies. The malware operation, codenamed "Hidden Risk," spreads through multiple stages via PDF files, using fake news headlines and cryptocurrency market research to lure users into downloading it.The malware package contains multiple features designed to provide hackers with a backdoor for remote access to victims' computers, stealing sensitive information, including private keys for digital asset wallets and platforms. According to cybersecurity company Recorded Future, North Korean hacker groups have stolen approximately $3 billion since 2017.

ChainCatcher news, the Gaia Hacker House, hosted by the decentralized AI infrastructure platform Gaia, has officially opened today. The event will continue to accept registrations until November 16 at 16:00 (GMT+7), in conjunction with Devcon 2024.It is reported that the Gaia Hacker House has transformed a luxury villa into an innovative, collaborative, and cutting-edge AI development center, providing not only accommodation but also serving as an incubator and knowledge space for the next generation of AI. Here, developers, researchers, founders, and visionaries gather to push the boundaries of the possibilities of intelligent agents.

ChainCatcher news, according to Decrypt, French multinational company Schneider Electric has suffered a ransomware attack, with the hacker group "Hellcat" demanding $125,000 worth of baguettes or the cryptocurrency Monero as ransom, or they will publicly release 40GB of sensitive data stolen from the company.It is reported that the group published the ransom note through anonymous social media accounts, claiming to have obtained key information about the company's customers and operations. This attack marks the third cyber attack on Schneider Electric in two years.The company has confirmed that it is investigating the incident, stating that the attacked platform is in a quarantined environment and that the company's products and services have not been affected. Analysts point out that the hackers' choice of baguettes as a demand is for "marketing" purposes, to increase their visibility in the ransomware market.

ChainCatcher message, according to on-chain detective ZachXBT, American rapper Wiz Khalifa's X account was hacked earlier today and false WIZ token information was posted. The attacker is the same person who hacked Andy Ayrey's (founder of Truth Terminal) X account a few days ago.The related posts have been deleted.