On-chain sleuth ZachXBT has published a report on the history of Lazarus Group – the infamous North Korean hacking group responsible for some of the largest crypto thefts in the industry’s history.
The article tracks 25 hacks affecting individuals and companies in crypto through which Lazarus laundered $200 million from digital assets to fiat between 2020 and 2023.
Lazarus Group’s $200 Million Money Trail
The analyst examined several six-figure crypto wallet hacks over the past several years, including hacks on several crypto exchange hot wallets in 2020. That includes $370,000 in Bitcoin (BTC) and Ether (ETH) stolen from former Canadian exchange Coinberry in August 2020, and $750,000 stolen from CoinMetro in October 2020.
Funds from Coinberry, CoinMetro, and others were consolidated in one address in early January, and slowly moved through Tornado Cash throughout the month. Tornado Cash is a privacy mixer protocol on Ethereum that’s since been sanctioned by the U.S. Treasury Department for allowing money launderers and terrorists to cover their tracks.
ZachXBT managed to track those funds on-chain despite their movement through the mixer based on the unique characteristics of their withdrawal transfers. Over the next two years, the assets were consolidated with funds from other Lazarus group thefts, and then sent to P2P crypto marketplaces like Paxful Noones as Tether (USDT).
“374K USDT was frozen in November 2023 and an undisclosed amount was frozen at centralized exchanges in Q4 2023,” tweeted ZachXBT on Monday. “An additional $3.4M was frozen by 3 of 4 stablecoin issuers sitting in a group of addresses.”
Using Chinese OTC Desks
Lazarus also made multiple transfers to China-based OTC trader Wu Huihui in 2021. It took until April 2023 before the Department of Justice (DOJ) unsealed an indictment against Wu alleging that he’d facilitated payments for the DPRK. ZachXBT said Chise OTC traders are a historical wrote used by Lazarus to convert crypto to fiat.
“Thousands of people in the space have been impacted directly and indirectly by Lazarus Group attacks and it seems that number will only continue to increase,” he concluded.
Analysis by Elliptic last year found that Lazarus was behind over $300 million worth of crypto hacks in 2023 alone. As of September, they held $47 million worth of crypto within their wallets.