DWF Labs a market-making firm active in crypto markets has been linked to an alleged loss of $44 million in a hack that took place in September 0 to on-chain investigators the incident was not publicly disclosed by the firm at the time and only came to light after a detailed blockchain 1 Labs: Alleged Attack And Method Reports have disclosed that the attacker drained a wallet tied to DWF Labs and moved the funds through several on-chain 2 stolen holdings were mostly stablecoins — USDC and USDT — and were then converted into Bitcoin through the Ren bridge before being routed into a mixer called 3 pattern of transfers and the tools used are what led some analysts to suggest a link to the DPRK-associated AppleJeus group. 2/8 On 22nd September 2022
the address 0x3d67fdE4B4F5077f79D3bb8Aaa903BF5e7642751 started being 4 the same time withdrawals were made from many exchanges to the same address showing that both private keys and exchange account credentials were likely 5 — tanuki42 (@tanuki42_) November 4 2025 On-Chain Evidence And Reactions Based on reports the investigation was driven by an analyst known as tanuki42 who flagged the wallet address and traced payments made to and from it before and after the alleged 6 sleuths on X
including well-known chain trackers began to comment and share 7 posts pointed to roughly $30 million in Bitcoin-valued pots that have not been touched since the transfers raising questions about what the attacker intends to do 8 Labs has not posted a public incident report or a formal acknowledgement of the 9 The Movement Looks Like Money moved into centralized exchanges at certain points which suggests private keys or exchange accounts may have been compromised during the 10 conversion
the flow into a mixer makes it harder to follow the exact trail but on-chain records show the sequence and timestamps that tie these steps to the September 11 way funds were handled is similar to other cases tied to state-linked threat actors according to the analysts studying the 12 Impact And Next Steps If the allegation is confirmed by an independent audit or by the firm itself the fallout could affect counterparties and projects that relied on DWF Labs for 13 forensic firms and trackers are poring over the dormant pots of Bitcoin that amount to about $30 million in current value
while exchanges and law-enforcement partners may be asked to help trace or freeze moves if they 14 confidence is part of the discussion now because public trust depends on clear disclosure and rapid response once a breach is 15 image from Unsplash chart from TradingView
Story Tags
Latest news and analysis from Bitcoinist
