Crypto exchanges freeze accounts tied to North Korea’s notorious Lazarus Group
- Reference: 1673936947
- News link: https://www.theregister.co.uk/2023/01/17/crypto_exchanges_freeze_lazarus_group/
- Source link:
This story starts with a crypto researcher who goes by “ZachXBT” and late last week [1]spotted an entity called “Lazarus Group” moving 41,000 ETH “from the Harmony Bridge hack through Railgun on Jan 13-14 2023 before depositing funds on three exchanges.”
1/2 North Korea’s Lazarus Group had a very busy weekend moving $63.5m (~41000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges. [2]pic.twitter.com/huDumaJeSh — ZachXBT (@zachxbt) [3]January 15, 2023
The Harmony bridge was a crypto-transfer service that was [4]attacked in June 2022, with around $100m of crypto lost as a result of the attack.
Analysts quickly identified Lazarus Group as the sort of entity that could be interested in attacking Harmony.
Lazarus Group is identified suspected of being a cybercrime crew run by the government of North Korea and is infamous for [5]the WannaCry ransomware , attacking [6]Sony Pictures and [7]stealing secrets from energy companies .
[8]
It later moved on to crypto heists and has been fingered for the [9]theft of $620 million of crypto from game developer Sky Mavis , publisher of a crypto-centric game named Axie Infinity.
[10]
[11]
North Korea steals crypto because sanctions make it hard for the rogue nation to access fiat currencies. The nation’s murderous regime conducts wholesale human rights abuses of its citizenry but needs funds to pursue the conventional missile and nuclear weapons programs that help to keep its rulers in power by making the cost of seeking regime change unacceptable to nations that oppose its violent autocracy.
The US State Department does, however, offer a $10 million reward [12]for information on North Korea’s state-sponsored hacking in the hope of more effectively combating North Korea’s cybercrime program.
[13]North Korea hits new low by using Seoul Halloween tragedy to exploit Internet Explorer zero-day
[14]North Korea using freelance techies to fund missiles and nukes
[15]North Korean attacks on crypto exchanges reportedly netted $316m in two years
[16]South Korean and US presidents gang up on North Korea's cyber-offensives
While cryptocurrency enthusiasts wax lyrical about the anonymity the tokens offer, the reality is it’s possible to track their movement. The likes of Lazarus Group therefore leave signs of their passing as they attempt to move stolen cryptocoin.
Those attempts were spotted by ZachXBT and also noticed by crypto exchange Binance which froze accounts allegedly involved in Lazarus Group’s efforts.
We detected Harmony One hacker fund movement. They previously tried to launder through Binance and we froze his accounts. This time he used Huobi. We assisted Huobi team to freeze his accounts. Together, 124 BTC have been recovered. CeFi helping to keep DeFi [17]#SAFU ! 🙏 — CZ 🔶 Binance (@cz_binance) [18]January 16, 2023
The “Huobi” referred to in the Tweet above is another crypto exchange and it, too, acted to prevent Lazarus Group resurrecting the proceeds of the Harmony heist for use by the North Korean regime.
The accounts frozen by Binance and Huobi amounted to 124BTC - $2.6 million at the time of writing.
[19]
That’s a decent chunk of change to deny North Korea’s regime. And perhaps a feather in the cap for the crypto community as it battles its ongoing infosec, regulatory, fraud, and existential woes. ®
Get our [20]Tech Resources
[1] https://www.chainabuse.com/report/0a2e8e00-00e2-4749-9b00-ceb1c6202d33?context=profile-other&username=ZachXBT
[2] https://t.co/huDumaJeSh
[3] https://twitter.com/zachxbt/status/1614771861266792449?ref_src=twsrc%5Etfw
[4] https://www.theregister.com/2022/06/24/harmony_100m_cryptocurrency_theft/
[5] https://www.theregister.com/2017/12/19/fco_confirms_north_korea_behind_wannacry/
[6] https://www.theregister.com/2018/09/06/us_north_korea_hacking/
[7] https://www.theregister.com/2022/09/08/lazarus_group_energy_firms_trade_secrets/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y8Z-1-fMfAlIQFE32a1z1QAAABU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[9] https://www.theregister.com/2022/09/09/cryptocurrency_lazarus_axie/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y8Z-1-fMfAlIQFE32a1z1QAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y8Z-1-fMfAlIQFE32a1z1QAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2022/07/27/north_korea_us_reward/
[13] https://www.theregister.com/2022/12/08/north_korea_seoul_tragedy_exploit/
[14] https://www.theregister.com/2022/12/09/dprk_tech_freelancer_military_funding/
[15] https://www.theregister.com/2021/02/10/north_korea_cryptocurrency/
[16] https://www.theregister.com/2022/05/23/s_korean_and_us_presidents/
[17] https://twitter.com/hashtag/SAFU?src=hash&ref_src=twsrc%5Etfw
[18] https://twitter.com/cz_binance/status/1614887319177428992?ref_src=twsrc%5Etfw
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y8Z-1-fMfAlIQFE32a1z1QAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[20] https://whitepapers.theregister.com/
Re: What's the catch
The catch is that criminals will think twice before signing cryptocurrency over to Binance because Binance might decide not to credit their account with fiat currency in return. It is the reverse of an FTX which took fiat currency and did not transfer any 'real' cryptocurrency to the wallets of the creditors.
Lazarus Group should be another nail in the coffin of shittocurrencies.
Growing Up?
If crypto wants to be taken seriously in financial circles, that means accepting internationally accepted standards of regulation including blocking criminal activity. Of course in this case the excchanges' interests align with those of law enforcement since this hacker group is targeting exchanges to steal crypto. Remains to be seen whether they will block assets of other known bad actors where they have no skin in the game themselves.
That's the tightrope to be walked between centralised control, which can be abused at a single control point but offers users some protection, vs complete decentralisation which is a de facto wild west.
Re: Growing Up?
The problem isn't really in decentralization per se, but rather with the fact that any Joe Schmo can declare himself part of the infrastructure without having to prove that he knows what he's doing (he doesn't).
Am I reading this right? So $63.5 million was stolen. And now $2.6 million has been frozen/captured? I know Crypto is in meltdown, but I kinda doubt by that much.... ;)
Well done you caught 4% of the stolen crypto. I'd normally say it's better than nothing, but well frankly, it seems more like a distraction. Move a small amount overtly, so that gets the headlines, so you can move the rest quietly and safely.
Or did that 3rd exchange who didnt block the stolen crypto (why no naming and shaming??? Assuming you can actually shame someone in crypto, but I digress...), did that 3rd exchange get the vast majority of the funds, probably because it seems they knew they wouldnt get frozen. I guess the Binance and Huobi quantities were a test to see if they could use those exchanges safely or not...
Norkocoin
Now you see it, now you don’t.
Binance exec: "You mean someone deposited 124 BTC and we can just repudiate their ownership? What's the catch?"
Not sure this redounds greatly to anyone's credit. If the "money" gets returned to where it was stolen from, that would be good I guess.