North Korean hackers Lazarus Group move 41,000 ETH stolen from Harmony Bridge attack

[stgpp0r5]

North Korea’s Lazarus Group have moved $63.5m (~41000 ETH) from the 2022 Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges (Binance, OKX and Huobi).



Full thread and analysis:

 

[stgpp0r5]

Lazarus Group laundered an additional 17,278 ETH through 6 different exchanges: https://www.chainabuse.com/report/2563e2f1-f2bf-4ba7-92f0-3dfd2fff0744

 

[stgpp0r5]

Further analysis of withdrawals:

@Harmonyprotocol Horizon Bridge #hack
1/
Withdrawals from #chipmixer after transferring via @Avalancheavax bridge moved in three ways:

1. chipmixer withdrawals -> Avalanche network -> BTC network -> Avalanche network -> Ethereum network-> swapped to USDT -> deposit on Exchanges
— BLIN Analytics (@BlinAnalytics) February 14, 2023

 

[stgpp0r5]

Binance and Huobi exchanges froze accounts containing $1.4 million stolen by North Korea’s Lazarus Group:

Exchanges @binance and @HuobiGlobal today froze accounts containing $1.4 million stolen by North Korea’s Lazarus Group. This was made possible thanks to intel from Elliptic’s real-time investigations tools and a swift response by the receiving exchanges.https://t.co/f5bVpm8yfH
— Elliptic (@elliptic) February 14, 2023

 

[Saga5300]

So railgun is a fake mixer? All money found and blocked on exchanges?

 

[XDRevil]

dunkel сказал(а):
Как они это делают? сидя в штабе за квадратными мониторами, с рационом рис+вода. Или там мотивация от начальства "кто не хакает того расстреливаем"?
Нажмите, чтобы раскрыть...

Возможно они в китае, или других стран

 

[dunkel]

XDRevil сказал(а):
Возможно они в китае, или других стран
Нажмите, чтобы раскрыть...

Спецуры со своими агентами во всех странах уже бы дотянулись до них. Думаю их просто много (5к человек в апт) и у них дисциплина жесткая