Lazarus Group's $200 Million Crypto Laundering Scheme Busted by On-Chain Sleuth

Pseudonymous on-chain investigator ZachXBT has published a comprehensive report detailing how North Korea's Lazarus Group laundered over $200 million in stolen cryptocurrency. The investigation spans 25 hacks from August 2020 to October 2023, uncovering sophisticated laundering techniques involving coin mixers, cross-blockchain transfers, and peer-to-peer exchanges like Noones and Paxful.

Lazarus Group's $200 Million Crypto Laundering Scheme Unraveled by On-Chain Investigator

April 30, 2024 - A meticulously detailed report by ZachXBT, an esteemed on-chain investigator operating under a pseudonym, has laid bare the intricate methods employed by the notorious North Korean hacking syndicate, Lazarus Group, to launder over $200 million in stolen cryptocurrency.

The extensive investigation, meticulously tracing 25 hacks perpetrated across multiple blockchains between August 2020 and October 2023, has exposed the highly sophisticated strategies employed by Lazarus Group to conceal the movement of illicit funds.

Coin Mixers and Cross-Blockchain Transfers: Obfuscating the Flow of Stolen Crypto

The report highlights Lazarus Group's extensive reliance on coin mixers, such as Ethereum-based Tornado Cash and Bitcoin's ChipMixer, to shroud the origins and destinations of their illicit transactions. By intermingling stolen funds with legitimate transactions, they have rendered it immensely challenging for law enforcement and financial investigators to trace the money trail back to its criminal source.

Furthermore, the hackers have employed cross-blockchain transfers, moving tokens across different blockchains to add another layer of complexity to their illicit operations, effectively obscuring the path of their stolen assets.

Peer-to-Peer Exchanges: Facilitating Conversion into Fiat Currency

In addition to utilizing coin mixers, Lazarus Group has also leveraged peer-to-peer (P2P) exchanges, which enable individuals to conduct direct transactions without the involvement of a centralized authority. The report specifically identifies Bitcoin P2P exchanges such as Noones and Paxful as platforms that have facilitated some of these illicit transfers, aiding the hackers in converting stolen digital assets into fiat currency.

Lazarus Group's History of Cybercrime: A Pattern of Colossal Theft

Lazarus Group has been implicated in a litany of high-profile cyberattacks, including a $41 million heist from gaming platform Stake.com and a staggering $622 million exploit of the Ronin bridge. These incidents form part of a broader pattern of cybercrimes that have netted the group a staggering $2 billion in stolen assets, according to reports from the Federal Bureau of Investigation (FBI).

Industry Collaboration: Joining Forces to Trace Stolen Funds

ZachXBT's investigation has greatly benefited from the invaluable insights provided by leading industry players, including cryptocurrency exchange Binance and the widely used Ethereum wallet MetaMask. Their cooperation has been instrumental in identifying numerous accounts suspected of being connected to Lazarus Group.

These accounts have allegedly received $44 million from the proceeds of the group's various cyber heists, with a portion of these illicit funds successfully converted into fiat currency.

Conclusion: Unraveling Lazarus Group's Illicit Crypto Laundering Network

The comprehensive investigation conducted by ZachXBT has played a pivotal role in exposing the sophisticated methods employed by Lazarus Group to launder stolen cryptocurrency. The report's findings highlight the critical need for ongoing vigilance and collaboration within the cryptocurrency industry to combat illicit activities and safeguard the integrity of the digital asset ecosystem.