Coin mixers and their use in high-profile hacks

Crypto mixers, or tumblers, are basically smart contracts used to hide the origin of crypto transactions.

Crypto mixers, also known as tumblers, are smart contracts that mix cryptocurrency from different users to conceal its original source. Hackers often use mixers to launder the cryptocurrency they steal. For example, if 10 users each mix 1 Ether (ETH), they will each contribute and receive different ETH.

Mixers are used to increase the financial privacy of crypto users, which can be used both maliciously by hackers or benignly by users who wish to protect their finances from surveillance.

While mixers are a common topic in crypto, they are only one part of a larger strategy that hackers use to launder their funds. They also use decentralized exchange (DEX) trading, peel chains and crypto bridging to complicate the tracking of their coins.

DEX trading is the process of exchanging cryptocurrencies directly between users on a decentralized exchange, without the need for an intermediary. A peel chain is a type of multi-wallet transfer where hackers send smaller and smaller amounts across each leg of the transfer instead of transferring large amounts.

Crypto bridging is the process of transferring cryptocurrency from one blockchain to another. For example, hackers could steal ETH from the Ethereum blockchain and then use a crosschain protocol to transfer the ETH to another chain, such as Bitcoin.

Together, these laundering techniques enable hackers to quickly and efficiently launder their stolen cryptocurrency.

Recently, North Korea’s Lazarus Group was seen using coin mixers and the decentralized crosschain protocol THORChain to launder the $1.46 billion stolen from Bybit just days after the hack.

This incident is part of a broader pattern of crypto theft and laundering by Pyongyang-based hackers, who are known for their rapid and efficient movements of stolen funds.

In 2024 alone, Lazarus Group is said to have stolen $800 million in crypto from various protocols, with the stolen funds being rapidly laundered through crypto mixers, intermediary wallets, DEXs and crosschain bridges using advanced laundering tactics.

Since 2017, Lazarus Group is estimated to have stolen over $5 billion in crypto, using platforms like Ren Bridge and Avalanche Bridge and often converting the funds into Bitcoin before employing mixers such as Tornado Cash, Sinbad, YoMix, Wasabi Wallet and CryptoMixer.

Some of the recent crypto hacks that Lazarus Group is known to have perpetrated include the hack of WazirX in July 2024, State.com in September 2023, CoinsPaid and Alphapo in July 2023, Harmony Horizon Bridge in June 2022 and Ronin Bridge in March 2022.

It is important to note that fraudulent organizations like the Lazarus Group are also suspected to run private mixers. Attributing wallets to these mixers requires careful consideration, as it carries a significant risk of wrongly identifying individuals who use them or are otherwise not involved.