Earlier, a confidential UN report obtained by Reuters showed that the North Korean hacker gang Lazarus Group laundered $147.5 million through the virtual currency platform Tornado Cash in March this year after stealing funds from a cryptocurrency exchange last year.
The monitors told the UN Security Council sanctions committee in a previous filing that they have been investigating 97 suspected cyberattacks by North Korean hackers against cryptocurrency companies worth about $3.6 billion between 2017 and 2024. These included an attack late last year in which $147.5 million was stolen from the HTX cryptocurrency exchange and then laundered in March of this year.
The United States imposed sanctions on Tornado Cash in 2022, and in 2023, its two co-founders were charged with assisting in the laundering of more than $1 billion, including from the Lazarus Group, a cybercrime organization linked to North Korea.
According to an investigation by cryptocurrency sleuth ZachXBT, the Lazarus Group laundered $200 million worth of cryptocurrency into fiat currency between August 2020 and October 2023.
In the field of cybersecurity, the Lazarus Group has long been accused of carrying out large-scale cyber attacks and financial crimes. Their targets are not limited to specific industries or regions, but are spread all over the world, from banking systems to cryptocurrency exchanges, from government agencies to private enterprises. Next, we will focus on analyzing several typical attack cases to reveal how the Lazarus Group successfully carried out these amazing attacks through its complex strategies and technical means.
Lazarus Group manipulates social engineering and phishing attacks
This case comes from relevant European media reports that Lazarus had previously targeted military and aerospace companies in Europe and the Middle East, posting recruitment advertisements on platforms such as LinkedIn to deceive employees, requiring job seekers to download PDFs with executable files deployed, and then carry out phishing attacks.
Both social engineering and phishing attacks attempt to use psychological manipulation to trick victims into letting their guard down and performing actions, such as clicking a link or downloading a file, that compromise their security.
Their malware enables agents to target vulnerabilities in victims' systems and steal sensitive information.
Lazarus used a similar method in a six-month operation against cryptocurrency payment provider CoinsPaid, which resulted in the theft of $37 million.
Throughout the campaign, it sent fake job offers to engineers, launched technical attacks such as distributed denial of service, and submitted many possible passwords for brute force cracking.
Create CoinBerry, Unibright and other attacks
On August 24, 2020, the wallet of Canadian cryptocurrency exchange CoinBerry was stolen.
Hacker Address:
0xA06957c9C8871ff248326A1DA552213AB26A11AE
On September 11, 2020, due to the leakage of private keys, unauthorized transfers of $400,000 occurred in multiple wallets controlled by the Unbright team.
Hacker Address:
0x6C6357F30FCc3517c2E7876BC609e6d7d5b0Df43
On October 6, 2020, due to a security breach, crypto assets worth $750,000 were transferred without authorization from CoinMetro’s hot wallet.
Hacker Address:
0x044bf69ae74fcd8d1fc11da28adbad82bbb42351
Beosin KYT: Stolen Funds Flow Chart
At the beginning of 2021, funds from various attacks were collected at the following addresses:
0x0864b5ef4d8086cd0062306f39adea5da5bd2603。
On January 11, 2021, the 0x0864b5 address deposited 3,000 ETH in Tornado Cash, and then deposited more than 1,800 ETH into Tornado Cash through the 0x1031ffaf5d00c6bc1ee0978eb7ec196b1d164129 address.
Subsequently, from January 11 to January 15, nearly 4,500 ETH were withdrawn from Tornado Cash to the address 0x05492cbc8fb228103744ecca0df62473b2858810.
By 2023, after multiple transfers and exchanges, the attacker finally gathered the funds to the address where the funds from other security incidents were collected and withdrawn. According to the fund tracking diagram, the attacker sent the stolen funds to the Noones deposit address and the Paxful deposit address one after another.
Nexus Mutual founder (Hugh Karp) was hacked
On December 14, 2020, Nexus Mutual founder Hugh Karp had 370,000 NXM (US$8.3 million) stolen.
Beosin KYT: Stolen Funds Flow Chart
The stolen funds were transferred between the following addresses and exchanged for other funds.
0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1
0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b
0x09923e35f19687a524bbca7d42b92b6748534f25
0x0784051d5136a5ccb47ddb3a15243890f5268482
0x0adab45946372c2be1b94eead4b385210a8ebf0b
Lazarus Group used these addresses to confuse, disperse, and aggregate funds. For example, some funds were transferred to the Bitcoin chain through a cross-chain, and then transferred back to the Ethereum chain through a series of transfers. After that, they were mixed through a mixing platform and then sent to a withdrawal platform.
From December 16 to December 20, 2020, one of the hacker addresses 0x078405 sent more than 2,500 ETH to Tornado Cash. A few hours later, based on feature association, it was found that the address 0x78a9903af04c8e887df5290c91917f71ae028137 started withdrawing funds.
The hacker transferred and exchanged part of the funds to the address for fund collection and withdrawal involved in the previous incident.
Afterwards, from May to July 2021, the attacker transferred 11 million USDT to the Bixin deposit address.
From February to March 2023, the attacker sent 2.77 million USDT to the Paxful deposit address through the 0xcbf04b011eebc684d380db5f8e661685150e3a9e address.
From April to June 2023, the attacker sent 8.4 million USDT to the Noones deposit address through the 0xcbf04b011eebc684d380db5f8e661685150e3a9e address.
Steadefi and CoinShift hacks
Beosin KYT: Stolen Funds Flow Chart
Steadefi incident attack address
0x9cf71f2ff126b9743319b60d2d873f0e508810dc
Coinshift attack address
0x979ec2af1aa190143d294b0bfc7ec35d169d845c
In August 2023, 624 stolen ETH from the Steadefi incident were transferred to Tornado Cash. In the same month, 900 stolen ETH from the Coinshift incident were transferred to Tornado Cash.
After transferring ETH to Tornado Cash, immediately withdraw the funds to the following addresses:
0x9f8941cd7229aa3047f05a7ee25c7ce13cbb8c41
0x4e75c46c299ddc74bac808a34a778c863bb59a4e
0xc884cf2fb3420420ed1f3578eaecbde53468f32e
On October 12, 2023, the above three addresses sent the funds withdrawn from Tornado Cash to the address 0x5d65aeb2bd903bee822b7069c1c52de838f11bf8.
In November 2023, the 0x5d65ae address began to transfer funds, and eventually sent the funds to the Paxful deposit address and Noones deposit address through transit and exchange.
Event Summary
The above introduces the dynamics of the North Korean hacker Lazarus Group in the past few years, and analyzes and summarizes its money laundering methods: After stealing crypto assets, Lazarus Group basically confuses funds by transferring them back and forth across chains and then into mixers such as Tornado Cash. After the obfuscation, Lazarus Group extracts the stolen assets to the target address and sends them to a fixed group of addresses for withdrawal operations. Previously, the stolen crypto assets were basically deposited into Paxful deposit addresses and Noones deposit addresses, and then the crypto assets were exchanged for legal currency through OTC services.
Under the continuous and large-scale attacks of Lazarus Group, the Web3 industry faces great security challenges. Beosin continues to pay attention to this hacker group and will further track its dynamics and money laundering methods to help project owners, regulators and law enforcement agencies combat such crimes and recover stolen assets.
