North Korea's Lazarus Group Laundered $200M in Crypto, Says Blockchain Sleuth—Here's How

Notorious North Korean hacker organization, Lazarus Group, has long been seen as a villain in the crypto world, allegedly pilfering billions in total from projects and networks. Now, pseudonymous on-chain sleuth ZachXBT has broken down exactly how the group apparently laundered over $200 million in hacked crypto funds into fiat currency.

Lazarus has been identified as the group behind some of the most noteworthy crypto-related hacks in recent years. It was named by the FBI as responsible for the $41 million hack on Drake-backed gaming firm Stake.com, as well as a $622 million exploit of the Ronin gaming network, collectively amassing over $2 billion in digital assets across its thefts.

In his extensive report, ZachXBT analyzed over 25 hacks spanning multiple blockchains, following capital through a number of coin mixers and exchanges, spanning three years from August 2020 to October 2023.

According to the report, the Lazarus Group used multiple mixers throughout its attempts to launder money. Crypto coin mixers attempt to scramble the origin and destination of a transaction by mixing it with other tokens, transactions, and addresses. The North Korean-linked hackers specifically used the Ethereum mixer Tornado Cash and Bitcoin-based ChipMixer.

Alongside repeatedly bridging tokens across blockchains to further obscure the path of funds, the hacker group also used peer-to-peer (P2P) exchanges. These exchanges allow individuals to directly exchange assets with each other without the involvement of a third party, such as an exchange. The group specifically used the Bitcoin P2P exchanges Noones and Paxful.

With help from industry heavyweights like crypto exchange Binance and leading Ethereum wallet MetaMask, ZachXBT has identified multiple accounts he believes to be linked to the Lazarus Group. The accounts in question received $44 million from Lazarus hacks, the online sleuth claims, and were able to successfully convert the hacked funds into fiat currency.

The results of his investigation are in line with previous reports that the Lazarus Group has laundered money through over-the-counter (OTC) traders, which settle transactions off of exchanges. The most notable example of this is Wu Huihui, who in April 2023 was alleged to have facilitated payments for the Democratic People's Republic of Korea. He was added to the Office of Foreign Assets Control’s Specially Designated Nationals List—a list of actors who are owned or controlled by targeted countries.

Edited by Andrew Hayward