North Korea-linked cybercrime syndicate Lazarus Group has reportedly transferred $63.4 million in Ethereum from 2022’s mammoth Harmony bridge hack, depositing it on Binance, Huobi, and OKX.
According to on-chain sleuth ZachXBT, the group used the privacy and anonymity system Railgun before consolidating the funds and depositing them on the exchanges.
Railgun is an Ethereum-based smart contract system that lets users obscure the nature of their crypto transactions, removing identifying information.
The sleuth claimed that the transfers, made on January 13, involved 350,000 separate wallet addresses.
1/2 North Korea’s Lazarus Group had a very busy weekend moving $63.5m (~41000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges. pic.twitter.com/huDumaJeSh
Binance CEO Changpeng “CZ” Zhao said that his team, in collaboration with Huobi, had detected the funds’ movements, which they then froze and recovered.
The Binance chief claimed that the total recovery came to 124 Bitcoin, suggesting that the attackers had converted funds from ETH to BTC.
Though Lazarus reportedly originally made the illegitimate transfers in the form ETH, these tokens could have been later swapped for BTC at many points during the mixing and consolidating process.
We detected Harmony One hacker fund movement. They previously tried to launder through Binance and we froze his accounts. This time he used Huobi. We assisted Huobi team to freeze his accounts. Together, 124 BTC have been recovered. CeFi helping to keep DeFi #SAFU! 🙏
The CEO added that he is not in those security chats himself and as a result, doesn’t “know the details.”
Decrypt has contacted Binance, Huobi, and OKX about the transfers and their responses.
Despite the size of Lazarus’s attack on Harmony, the hack is just a small portion of the overall number of funds the cybercrime syndicate has been implicated in stealing.
Lazarus was also implicated, to give just an example, in the March 2022 attack on the Ronin Network, which was estimated at being worth about $622 million. The group was also tied to a scheme that impersonated venture capital companies to spread malware to various crypto-related firms.
Stay on top of crypto news, get daily updates in your inbox.