Earlier, a confidential UN report obtained by Reuters showed that the North Korean hacker gang Lazarus Group laundered $147.5 million through the virtual currency platform Tornado Cash in March this year after stealing funds from a cryptocurrency exchange last year.
The monitors told the UN Security Council sanctions committee in a previous filing that they have been investigating 97 suspected cyberattacks by North Korean hackers against cryptocurrency companies between 2017 and 2024, worth about $3.6 billion. These included an attack late last year in which $147.5 million was stolen from the HTX cryptocurrency exchange and then laundered in March of this year.
The United States imposed sanctions on Tornado Cash in 2022, and in 2023 its two co-founders were charged with facilitating the laundering of more than $1 billion, including by the Lazarus Group, a cybercrime organization linked to North Korea.
According to an investigation by crypto sleuth ZachXBT, the Lazarus Group laundered $200 million worth of cryptocurrencies into fiat currencies between August 2020 and October 2023.
In the field of cybersecurity, the Lazarus Group has long been accused of carrying out large-scale cyber attacks and financial crimes. Their targets are not limited to specific industries or regions, but are spread all over the world, from banking systems to cryptocurrency exchanges, from government agencies to private enterprises. Next, we will focus on analyzing several typical attack cases to reveal how the Lazarus Group successfully carried out these amazing attacks through its complex strategies and technical means.
Lazarus Group conducts social engineering and phishing attacks
This case comes from relevant European media reports that Lazarus previously targeted military and aerospace companies in Europe and the Middle East, posted recruitment advertisements on platforms such as LinkedIn to deceive employees, and asked job seekers to download PDFs with executable files deployed, and then carried out phishing attacks.
Both social engineering and phishing attacks attempt to use psychological manipulation to trick victims into letting their guard down and performing actions, such as clicking a link or downloading a file, that compromise their security.
Their malware enables agents to target vulnerabilities in victims' systems and steal sensitive information.
Lazarus used a similar method in a six-month operation against cryptocurrency payment provider CoinsPaid, which resulted in the theft of $37 million.
Throughout the campaign, it sent fake job offers to engineers, launched technical attacks such as distributed denial of service, and submitted many possible passwords for brute force cracking.
Create CoinBerry, Unibright and other attacks
On August 24, 2020, the wallet of Canadian cryptocurrency exchange CoinBerry was stolen.
Hacker Address:
0xA06957c9C8871ff248326A1DA552213AB26A11AE
On September 11, 2020, due to the leakage of private keys, Unbright experienced unauthorized transfers of $400,000 in multiple wallets controlled by the team.
Hacker Address:
0x6C6357F30FCc3517c2E7876BC609e6d7d5b0Df43
On October 6, 2020, due to a security breach, crypto assets worth $750,000 were transferred without authorization from CoinMetro’s hot wallet.
Hacker Address:
0x044bf69ae74fcd8d1fc11da28adbad82bbb42351
Beosin KYT: Stolen Funds Flow Chart
At the beginning of 2021, funds from various attacks were collected at the following addresses:
0x0864b5ef4d8086cd0062306f39adea5da5bd2603。
On January 11, 2021, the 0x0864b5 address deposited 3,000 ETH in Tornado Cash, and then deposited more than 1,800 ETH into Tornado Cash through the 0x1031ffaf5d00c6bc1ee0978eb7ec196b1d164129 address.
Subsequently, from January 11 to January 15, nearly 4,500 ETH were withdrawn from Tornado Cash to the address 0x05492cbc8fb228103744ecca0df62473b2858810.
By 2023, after multiple transfers and exchanges, the attacker finally gathered the funds to the address where the funds from other security incidents were collected and withdrawn. According to the fund tracking diagram, the attacker sent the stolen funds to the Noones deposit address and the Paxful deposit address one after another.
Nexus Mutual founder (Hugh Karp) hacked
On December 14, 2020, Nexus Mutual founder Hugh Karp had 370,000 NXM (US$8.3 million) stolen.
Beosin KYT: Stolen Funds Flow Chart
The stolen funds were transferred between the following addresses and exchanged for other funds.
0xad6a4ace6dcc21c93ca9dbc8a21c7d3a726c1fb1
0x03e89f2e1ebcea5d94c1b530f638cea3950c2e2b
0x09923e35f19687a524bbca7d42b92b6748534f25
0x0784051d5136a5ccb47ddb3a15243890f5268482
0x0adab45946372c2be1b94eead4b385210a8ebf0b
Lazarus Group used these addresses to obfuscate, disperse, and aggregate funds. For example, part of the funds were transferred across chains to the Bitcoin chain, and then back to the Ethereum chain through a series of transfers. They were then mixed through a mixing platform and then sent to the withdrawal platform.
From December 16 to December 20, 2020, one of the hacker addresses 0x078405 sent more than 2,500 ETH to Tornado Cash. A few hours later, based on feature association, it can be found that the address 0x78a9903af04c8e887df5290c91917f71ae028137 started the withdrawal operation.
The hacker transferred part of the funds to the fund collection and withdrawal address involved in the previous incident through transfer and exchange.
Afterwards, from May to July 2021, the attacker transferred 11 million USDT to the Bixin deposit address.
From February to March 2023, the attacker sent 2.77 million USDT to the Paxful deposit address through the 0xcbf04b011eebc684d380db5f8e661685150e3a9e address.
From April to June 2023, the attacker sent 8.4 million USDT to the Noones deposit address through the 0xcbf04b011eebc684d380db5f8e661685150e3a9e address.
Steadefi and CoinShift hack
Beosin KYT: Stolen Funds Flow Chart
Steadefi incident attack address
0x9cf71f2ff126b9743319b60d2d873f0e508810dc
Coinshift attack address
0x979ec2af1aa190143d294b0bfc7ec35d169d845c
In August 2023, 624 stolen ETH from the Steadefi incident were transferred to Tornado Cash. In the same month, 900 stolen ETH from the Coinshift incident were transferred to Tornado Cash.
After transferring ETH to Tornado Cash, immediately withdraw the funds to the following addresses:
0x9f8941cd7229aa3047f05a7ee25c7ce13cbb8c41
0x4e75c46c299ddc74bac808a34a778c863bb59a4e
0xc884cf2fb3420420ed1f3578eaecbde53468f32e
On October 12, 2023, the above three addresses sent the funds withdrawn from Tornado Cash to the 0x5d65aeb2bd903bee822b7069c1c52de838f11bf8 address.
In November 2023, the 0x5d65ae address began to transfer funds, and eventually sent the funds to the Paxful deposit address and Noones deposit address through transit and exchange.
Event Summary
The above introduces the dynamics of the North Korean hacker Lazarus Group in the past few years, and analyzes and summarizes its money laundering methods: After stealing crypto assets, Lazarus Group basically confuses funds by transferring them back and forth across chains and then into mixers such as Tornado Cash. After the obfuscation, Lazarus Group extracts the stolen assets to the target address and sends them to a fixed group of addresses for withdrawal operations. Previously, the stolen crypto assets were basically deposited into Paxful deposit addresses and Noones deposit addresses, and then the crypto assets were exchanged for legal currency through OTC services.
Under the continuous and large-scale attacks of Lazarus Group, the Web3 industry faces great security challenges. Beosin continues to pay attention to this hacker group and will further track its dynamics and money laundering methods to help project owners, regulators and law enforcement agencies combat such crimes and recover stolen assets.
As one of the earliest Web3 security companies in the world engaged in formal verification, Beosin focuses on the "security + compliance" full-ecosystem business and has established branches in more than 10 countries and regions around the world. Its business covers code security audits before project launch, security risk monitoring and blocking during project operation, stolen recovery, virtual asset anti-money laundering (AML), and compliance assessments that meet local regulatory requirements, etc. "One-stop" blockchain compliance products + security services.