North Korea’s Lazarus Group Continues to Launder Stolen Funds from Bybit Hack
Recently, North Korea’s notorious Lazarus Group successfully laundered an additional 62,200 Ether, valued at approximately $138 million, stemming from the February 21 Bybit hack. According to a pseudonymous cryptocurrency analyst, only 156,500 Ether now remains to be moved.
Overview of the Bybit Hack
The Bybit hack, which occurred on February 21, resulted in the theft of 499,000 Ether (ETH), representing one of the largest crypto thefts in history, totaling around $1.4 billion. Reports indicate that around 343,000 Ether have already been moved, marking a significant 68.7% of the stolen assets, an increase from 54% just days prior on February 28. The pseudonymous analyst known as EmberCN has predicted that the remaining funds will likely be cleared within three days.
Impact of Law Enforcement Efforts
In recent weeks, the laundering of stolen cryptocurrency has shown signs of slowdown. This has been attributed to coordinated efforts by the Federal Bureau of Investigation (FBI). The agency has urged cryptocurrency exchanges, node operators, and bridges to actively block transactions associated with the Bybit hackers. Despite these efforts, the Lazarus Group has continued to find ways to move the stolen assets.
Details on Laundered Funds
The hackers have converted parts of the stolen Ether into Bitcoin (BTC), the Dai (DAI) stablecoin, and various other digital assets using decentralized exchanges and instant swap services, which often do not require Know Your Customer (KYC) compliance.
THORChain’s Involvement and Fallout
One of the platforms utilized by the hackers includes the crosschain asset swap protocol known as THORChain. This protocol has faced intense scrutiny due to its role in facilitating significant transfers tied to the North Korean group. A developer associated with THORChain, known as “Pluto,” has announced their departure from the project following a controversial vote that rejected measures aimed at blocking transactions linked to North Korean hackers.
Furthermore, THORChain’s founder, John-Paul Thorbjornsen, stated that he has dissociated from the protocol while clarifying that none of the sanctioned wallets according to the FBI and the U.S. Treasury’s Office of Foreign Assets Control have interacted with THORChain.
Previous Notable Hacks
The Bybit breach sets a new record as the most significant exploit in the cryptocurrency realm, dwarfing the $650 million hack of the Ronin bridge that took place on March 23, 2022. This recent event underscores growing vulnerabilities within the digital finance landscape, prompting stronger calls for enhanced security measures across platforms.
