In November 2023, $100 million in cryptocurrency was stolen from the cryptocurrency #биржи HTX and its cross-chain bridge known as the HECO Bridge. Elliptic and others attributed the theft to the North Korean Lazarus group, based on various indications of the hack and subsequent movement of funds.

Following common cryptocurrency laundering schemes, the stolen tokens were immediately exchanged for ETH using decentralized exchanges. The stolen funds then lay dormant until yesterday, March 13th, when stolen crypto assets began being sent through Tornado Cash.

Tornado cash is a decentralized mixer based on smart contracts. He was sanctioned by the US Treasury in August 2022 for his role in laundering $455 million from the Lazarus Group cryptocurrency hacks. In response, Lazarus Group stopped using Tornado Cash, instead relying on the use of cross-chain bridges and a Bitcoin-based mixer, Sinbad.io.

But in November 2023, Sinbad.io itself was seized by US authorities, which ruled out another mixing option.