NEAR Protocol Security Incident Update: Fund Flow and Potential Connections

New developments have emerged in the tracking of a recent security incident targeting the NEAR ecosystem. According to data published by a blockchain security firm, the address responsible for the attack has begun moving the illicit funds.

Exposed Path of Fund Movement

Monitoring information reveals a two-step process undertaken by the attacker to handle the stolen assets:

  • Step 1: Transfer to Centralized Exchange The funds were moved to the KuCoin cryptocurrency exchange. This step is often critical for attackers attempting to cash out or obfuscate the assets.
  • Step 2: Cross-Chain Asset Conversion Subsequently, the funds were bridged from the original chain and converted to Bitcoin (BTC). Converting assets to Bitcoin is a common strategy in hacker money laundering processes due to its high liquidity and relative tracing complexity.

Critical Lead Points to State-Sponsored Hacking Group

The most notable finding in this incident is that the attacker's address interacted with a previously tagged blockchain address. This tagged address (0x098B7...E2f96) is associated with a notorious entity—the North Korean hacking collective known as the Lazarus Group.

The Lazarus Group is identified by multiple governments and cybersecurity firms as a North Korean state-sponsored Advanced Persistent Threat (APT) group, long active in cyber attacks and financial theft targeting cryptocurrency exchanges and DeFi protocols. While this interaction record does not provide definitive proof of the attacker's identity, it constitutes a highly suspicious correlative link.

Impact and Industry Implications

This event underscores the ongoing security challenges within the decentralized finance space, particularly from sophisticated, state-backed threats. For projects and investors, this means:

  • A continuous need to enhance security audits and monitoring at the smart contract and protocol layers.
  • Maintaining high vigilance regarding abnormal large-scale fund movements and cross-chain transactions.
  • The industry should strengthen intelligence sharing to collectively address risks from advanced threat groups.

Investigations into the matter are ongoing. Security experts advise affected platforms and users to closely monitor fund flows and cooperate with law enforcement regarding potential asset recovery.