🌎 Lazarus Group Intensifies Crypto Laundering

North Korea’s Lazarus Group Steps Up Efforts to Launder Funds from $1.4 Billion Crypto Hack

The notorious North Korean hacking group, Lazarus Group, has intensified its efforts to launder funds stolen from cryptocurrency exchange Bybit, following the largest crypto hack in history, valued at $1.4 billion.

On March 1, the cyberattackers moved another 62,200 ETH, equivalent to $138 million, leaving them with approximately 156,500 Ethereum remaining from the original theft, according to crypto researcher EmberCN’s analysis.

This latest transfer brings the total amount laundered to around 343,000 ETH, which is close to 68.7% of the 499,000 ETH stolen during the February 21 attack. Based on the current pace, EmberCN projects that the hackers will clear the remaining funds within the next three days.

FBI Intervention and Attribution

Despite recent intervention by the Federal Bureau of Investigation (FBI), the hackers continue to accelerate their laundering efforts. On February 26, the FBI formally attributed the $1.5 billion hack to North Korea in a public service announcement.

The FBI has designated this specific North Korean cyber operation as “TraderTraitor.” According to the announcement, TraderTraitor actors are moving quickly, having already converted portions of the stolen assets to Bitcoin and other cryptocurrencies dispersed across thousands of addresses on multiple blockchains.

FBI officials expect these assets to be further laundered and eventually converted to fiat currency. The FBI is actively calling for assistance from the private sector and has asked various virtual asset service providers to block transactions connected to addresses used by the TraderTraitor actors to launder the stolen assets.

Laundering Techniques and Monitoring Efforts

Blockchain analytics firm Chainalysis reports that the hackers have used various mixing techniques to hide the trail of stolen funds. They have also converted portions of the Ethereum into Bitcoin, DAI stablecoin, and other assets.

The group has primarily used decentralized exchanges, cross-chain bridges, and instant swap services without Know Your Customer (KYC) requirements. Elliptic, a blockchain analytics firm, has expanded monitoring efforts by flagging over 11,000 wallet addresses potentially tied to the operation.