North Korea-linked cybercrime syndicate Lazarus Group has reportedly transferred $63.4 million in Ethereum from 2022’s mammoth Harmony bridge hack, depositing it on Binance, Huobi, and OKX.
According to on-chain sleuth ZachXBT, the group used the privacy and anonymity system Railgun before consolidating the funds and depositing them on the exchanges.
Railgun is an Ethereum-based smart contractsmart contract system that lets users obscure the nature of their crypto transactions, removing identifying information.
The sleuth claimed that the transfers, made on January 13, involved 350,000 separate wallet addresses.
1/2 North Korea’s Lazarus Group had a very busy weekend moving $63.5m (~41000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges. pic.twitter.com/huDumaJeSh
Binance CEO Changpeng “CZ” Zhao said that his team, in collaboration with Huobi, had detected the funds' movements, which they then froze and recovered.
The Binance chief claimed that the total recovery came to 124 Bitcoin, suggesting that the attackers had converted funds from ETH to BTC.
Though Lazarus reportedly originally made the illegitimate transfers in the form ETH, these tokens could have been later swapped for BTC at many points during the mixing and consolidating process.
We detected Harmony One hacker fund movement. They previously tried to launder through Binance and we froze his accounts. This time he used Huobi. We assisted Huobi team to freeze his accounts. Together, 124 BTC have been recovered. CeFi helping to keep DeFi #SAFU! 🙏
In June 2022, the Harmony attack saw hackers run off with $100 million after compromising the project’s token bridge. A blockchain bridge that connects different, incompatible blockchains together.
Many, including blockchain analytics company Elliptic, attributed the attack to the North Korean state-sponsored hacking group Lazarus.
In an extensive talk with Decrypt's Dan Roberts at Camp Decrypt in Napa CA in October, Edward Snowden gave his candid views on the Ethereum merge, the sanctioning of Ethereum mixer Tornado Cash by the U.S. government, the privacy shortcomings of Bitcoin and Ethereum, and his view on using DAOs to source tips from whistleblowers.
It’s unknown, what if any, steps have been taken by OKX, in response to the alleged criminal transfers.
CZ explained that Binance’s security teams are to an extent collaborative and talk to other exchanges, but added that “not all” other exchanges are collaborative.
Our security teams talk to each other, not all exchanges are collaborative (some have a wrong competitive mindset), but many are. I am actually not in those chats myself. Don't know the details.
The CEO added that he is not in those security chats himself and as a result, doesn’t “know the details.”
Decrypt has contacted Binance, Huobi, and OKX about the transfers and their responses.
Despite the size of Lazarus’s attack on Harmony, the hack is just a small portion of the overall number of funds the cybercrime syndicate has been implicated in stealing.
Lazarus was also implicated, to give just an example, in the March 2022 attack on the Ronin Network, which was estimated at being worth about $622 million. The group was also tied to a scheme that impersonated venture capital companies to spread malware to various crypto-related firms.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Public Keys is a weekly roundup from Decrypt that tracks the key publicly traded crypto companies. This week: Reading tea leaves during Circle and eToro quiet periods, Bitcoin miners selling a lot of Bitcoin, and Semler Scientific offering securities to raise cash to buy Bitcoin to secure a loan to pay the DOJ.
It’s oh so quiet
There was a jolt of excitement this week when USDC stablecoin issuer Circle told Decrypt the company is in a mandatory quiet period on account of having filed their S-1 a...
Kraken has reorganized its staff across multiple departments in recent months as part of a strategic move before its planned initial public offering next year.
A Kraken spokesperson told Decrypt that the company continuously evaluates its workforce to ensure it aligns with its strategic priorities.
“We’re approaching this with discipline and intention, making the difficult decision to eliminate certain roles and consolidate teams where redundancies exist, while continuing to hire in key areas of...
eXch crypto exchange will shut down operations on May 1 following links to the $1.4 billion Bybit hack and an "active transatlantic operation," the team said Thursday.
eXch is a privacy-focused crypto exchange known for operating without typical KYC, or know-your-customer) requirementsThe closure comes amid mounting allegations that eXch was complicit in the $1.4 billion Bybit hack in February, allegedly facilitating money laundered by North Korea's Lazarus hacker ring.
The exchange cited an "ac...
