🚨 $4.2M USDC Bridge Movement from Dormant Wallet Linked to 2023 Stake.com Exploit Pattern

A wallet address (0x7a3b...9f2c) dormant since June 2023 just activated and bridged $4.2M in USDC from Arbitrum to a fresh Ethereum wallet with zero transaction history. The originating wallet was previously flagged in Elliptic's database as receiving 83 ETH from a sanctioned mixer address associated with the July 2023 Stake.com drain.

The 271-day dormancy followed by a single large bridge to a clean wallet matches the pre-laundering staging pattern used in three known DeFi exploits from Q1-Q3 2023.

Behavioral flags are stacking rapidly: the destination wallet was funded exactly 3 hours before the bridge with 0.15 ETH for gas from a third intermediary that shares an IP cluster with six other wallets all created within the same 90-minute window this morning.

Total value of the cluster now sits at $8.7M across four chains, with no interaction history beyond gas funding and bridging. The speed of wallet creation, the dormancy-to-activation timing, and the use of a fresh gas funder mirror the OODA loop timing observed in Lazarus Group–attributed operations, specifically the Atomic Wallet and CoinsPaid incidents.

The stablecoin is now sitting idle in the new Ethereum wallet. No mixing yet, no deposit to any CEX address we track. This is likely the staging phase — park the funds, test the security response, and if no freeze occurs within 24–48 hours, proceed to the obfuscation layer.