Ai Yi corrected that 74560000 tokens ARB were transferred into a Security Council custody address, and this operation was likely not hacker activity.
Article
Analysis: The hacker behind this attack on Binance's hot wallet and the previous Kelp DAO attacker are suspected to be the same group.
PANews October 30 reported that, according to monitoring by on-chain analyst Ai Yi, the hacker behind this attack on Binance's hot wallet and the previous Kelp DAO attacker are suspected to be the same group. 30 minutes ago, the Binance hacker transferred 74560000 tokens ARB in full to address 0x0000000000000000000000000000000000000DA0, which Arkham labeled as Kelp DAO Hacker; these tokens have not yet been transferred or sold.Kelp DAO was attacked this year April 18, losing approximately 292000000 USD in rsETH. At the time, the community speculated that it was the North Korean hacking group Lazarus Group.
Ai Yi issued a correction, stating: After verification, 0x0000000000000000000000000000000000000DA0 was involved in the theft incident at the time, where the Arbitrum Security Council, in order to handle frozen assets, deliberately used a vanity address matching Kelp DAO characteristics as a multisig or temporary custody address; this transaction was likely not hacker activity, but merely confusion caused by an on-chain Entity.
🔗DAO Correction: The relevant address is a custody address of the Arbitrum Security Council, not a hacker transfer https://www.panewslab.com/zh/articles/01a18a4b-909e-7331-b572-f880ed0f5453
Key points
01
PANews said that on-chain analyst Ai Yi initially suspected that the attacker behind this Binance hot-wallet attack and the previous Kelp DAO attacker were the same group.
02
The article stated that 74560000 tokens ARB were all transferred to address 0x0000000000000000000000000000000000000DA0。
03
This address was labeled by Arkham as “Kelp DAO Hacker,” and the related tokens had not yet been transferred or sold at that time.
04
The article stated that Kelp DAO was attacked this year April 18, losing approximately 292000000 USD in rsETH.
05
Ai Yi subsequently corrected that the address was a multisig or temporary custody address used by the Arbitrum Security Council to handle frozen assets.
06
Ai Yi said this transaction was likely not hacker activity, but confusion caused by an on-chain Entity label.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
The initial address label led analysts to believe that the attacks may have been carried out by the same group; after verification, Ai Yi said that the receiving address was actually used to custody or handle frozen assets, and therefore withdrew this attribution.
Why it matters to readers
This correction weakens the conclusion that “the attacker behind the Binance hot-wallet attack is the same as the Kelp DAO attacker,” and also shows that relying solely on on-chain address labels may lead to incorrect attribution.
Beginners should note that although blockchain transfer records are public, address labels and the identities of controllers are not necessarily accurate; when encountering attribution of a security incident, they should also review subsequent corrections.
Risks and unknowns
The original article did not provide formal confirmation from the Arbitrum Security Council regarding the purpose of this address.
The original article did not explain how 74560000 tokens ARB would subsequently be handled.
The true identity of the Binance hot-wallet attacker and its relationship to the Kelp DAO incident remain unconfirmed.
Lazarus Group was only a community speculation stated in the article.
Related Developments
Loading event timeline…
Related concepts
Hot wallet
A wallet kept connected to the internet for convenience, better suited to everyday scenarios such as frequent transactions.
