North Korea’s Lazarus Group moved 41,000 Ethereum (roughly $64 million) from the Harmony Bridge hack over the weekend, according to blockchain sleuth ZachXBT on January 16.
The crypto assets came from Tornado Cash’s anonymizing service and were passed via Railgun, a platform for private smart contracts that conceals transactions using zero-knowledge proofs.
1/2 North Korea’s Lazarus Group had a very busy weekend moving $63.5m (~41000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges. pic.twitter.com/huDumaJeSh
— ZachXBT (@zachxbt) January 15, 2023
The researcher tracked the transactions through more than 350 addresses and found that 41,000 ETH, worth around $63.5 million, were routed through the transaction-hiding platform before being deposited on three distinct exchanges.
Although the exchanges used by the exploiters were not mentioned, the analyst stated that the funds are often withdrawn very quickly.
Binance and Huobi Security Teams Recovered Some Stolen Assets
But in their most recent attempt, Harmony’s hackers attempted to launder the money via Huobi, another cryptocurrency exchange. However, Huobi was able to freeze their accounts with the help of Binance’s security staff, according to CZ.
We detected Harmony One hacker fund movement. They previously tried to launder through Binance and we froze his accounts. This time he used Huobi. We assisted Huobi team to freeze his accounts. Together, 124 BTC have been recovered. CeFi helping to keep DeFi #SAFU! 🙏
— CZ 🔶 Binance (@cz_binance) January 16, 2023
Together, the two exchanges have recovered around 124 bitcoins or about $2.6 million at the time of writing.
The security team of Binance was able to recover the assets because some of the exchange’s security teams talk to each other. Although not all centrally organized exchanges are collaborative, as noted by CZ, some have the wrong competitive mindset.
Huobi’s adviser, Justin Sun, responded to CZ’s tweet by thanking their dedicated staff and Binance Exchange for working together to identify and prevent the exploiter from laundering the assets through Huobi Global.
Lazarus has gotten highly skilled at moving illegal cryptocurrencies while evading authorities. Elliptic, a blockchain research firm, issued a full report on the assault at the time, attributing the Harmony Bridge hack in June 2022 to the cyber gang.
Elliptic asserts that the nature of the breach and the subsequent laundering of the stolen cryptocurrency assets show that they are consistent with the Lazarus Group’s actions.
The Harmony Protocol team has been collaborating with the Federal Bureau of Investigation (FBI) and authorities to recoup stolen funds ever since the hack in June 2022.
The protocol had offered a 1% reward for the recovery of $100 million worth of stolen cryptocurrency. Soon after, Harmony’s team raised the reward to $10 million, but to date, it has never had a reasonable response.
