ZachXBT has uncovered a money laundering operation allegedly tied to the Lazarus Group, a notorious North Korean hacking group. The group is suspected of being behind the May 2024 hack of Japanese cryptocurrency exchange DMM Bitcoin, where they stole a staggering $305 million in Bitcoin.
According to ZachXBT, over $35 million of the stolen funds have been moved this month to Huione Guarantee, an online marketplace operating in Cambodia. Blockchain forensics firm Elliptic linked Huione Guarantee to Cambodia’s ruling family and reported that the marketplace has facilitated over $11 billion in transactions from hacks, scams, and other illicit activities.
1/4 So far in July 2024 more than $35M from the $305M DMM Bitcoin hack has been laundered to the online marketplace Huione Guarantee
It is suspected that Lazarus Group is behind the hack due to similarities in laundering techniques and off chain indicators. pic.twitter.com/g1ndlttBll
— ZachXBT (@zachxbt) July 14, 2024
The laundering process appears to involve multiple steps. The hackers first convert the stolen Bitcoin to anonymous tokens using privacy-mixing services. These tokens are then swapped for other cryptocurrencies like Ethereum or Avalanche. Finally, the funds are converted into Tether (USDT), a stablecoin pegged to the US dollar, and transferred to Huione Guarantee.
However, efforts are underway to thwart these attempts. Tether, the issuer of USDT, blacklisted a Tron wallet address associated with the Lazarus Group on July 12th, preventing them from transferring an additional $28.2 million to Huione.
TNVaKWQzau7xL9bcnvLmF9KSEQkWEs4Ug8
Timestamp: 12.07.2024, 23:21:36 UTC
Event: AddedBlackList
Balance: 28,257,162.94 USDT (TRC20)https://t.co/Whl97I1K7m— USDT/USDC Ban List (@USDTBanList) July 12, 2024
ZachXBT also shared a list of 538 wallet addresses believed to be linked to the Lazarus Group, Huione Guarantee, and others involved in the DMM Bitcoin hack. This information is valuable for investigators and exchanges tracking the movement of stolen funds.
