Lazarus Group withdraws stolen funds worth of $1.2M in Bitcoin

Crypto Bitcoin – upload.wikimedia.org

On Monday, North Korean hackers, known as the Lazarus Group, withdrew stolen funds worth $1.2 million in Bitcoin. This move marked the unit’s largest transaction in over a month following weeks of inactivity.

Data from Arkham Intelligence show that the Lazarus Group transferred 27.371 BTC in two transactions from what the analysts identified as a cryptocurrency mixer.

“The Lazarus Group just made its biggest transactions in over a month, withdrawing $1M in BTC from what appears to be a mixing service this morning, then sending $150K of that to an inactive address they’ve sent to before,” said Arkham in a social media post.

A coin mixer, also known as a tumbler, is a blockchain-based protocol used to hide the ownership of cryptocurrencies. It mixes them with coins from other users before redistributing them, making it difficult to trace who received which coins. Normally, blockchains offer transparency, allowing straightforward tracking of cryptocurrency’s origin and transactions.

Lazarus also sent 3.343 BTC, worth $150,582, to a previously inactive address they had used before.

Arkham revealed a $79 million portfolio for Lazarus after the transactions. The analyst highlighted that these transfers might suggest preparation for further activity.

According to CoinTelegraph, the Lazarus Group is said to be supported by the North Korean government. In 2023, it was accused of about a third of all hacks, making around $700 million that year. The group reportedly used creative methods like fake job offers and pretending to be famous venture capitalists to access their targets.

Other notorious hacks

In recent years, Lazarus Group’s crypto heists have caused major problems in the market.

Cybersecurity company Recorded Future revealed that Lazarus has stolen $3 billion through hacks and exploits in the crypto industry since 2017.

In its October 2023 report, Recorded Future highlighted Lazarus’s significant milestone in hacking the crypto industry, saying, “Initially successful in stealing from financial institutions through the hijacking of the SWIFT network, North Korea shifted its attention to cryptocurrency during the 2017 bubble, starting with the South Korean market and later expanding globally.”

Per the report, these hackers also managed to hack $1.7 billion in cryptocurrency in 2022, a sum equivalent to five percent of North Korea’s economy.

“The stolen funds, often laundered using methods similar to traditional cybercriminal groups, contribute to the regime’s revenue, allowing it to operate despite international sanctions,” the report reads.

The U.S. Treasury Department connected the $600 million “Axie Infinity” Ronin bridge exploit to Lazarus. This attack on the network resulted in stealing 173,600 ether, around $597 million, and $25.5 million worth of the stablecoin USDC.

Following the incident, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned the crypto mixer Blender.io. The agency also imposed sanctions on another crypto-mixing tool called Tornado Cash and individuals associated with it due to their alleged ties to Lazarus.

Last year, Lazarus participated in around a third of all cryptocurrency exploits and thefts, taking approximately $600 million in funds, as per a TRM Labs report.

“Hacks perpetrated by the DPRK were on average ten times as damaging as those not linked to North Korea. Nearly USD 3 billion worth of crypto has been lost to Pyongyang-linked threat actors since 2017,” TRM Labs said in a recent report.

The report highlighted that North Korea’s hacking activities have resulted in the theft of nearly USD 1.5 billion in the past two years. It emphasized the necessity for ongoing vigilance and innovation from businesses and governments.

“Despite notable advancements in cybersecurity among exchanges and increased international collaboration in tracking and recovering stolen funds, 2024 is likely to see further disruption from the world’s most prolific cyber-thief,” TRM said.