The infamous North Korean Lazarus hacking group is the prime suspect in the $100 million hack of Harmony’s Horizon Bridge, according to new data and research from blockchain analytics firm Elliptic.
The multi-million compromise, confirmed by Harmony earlier this month, led to the theft of ETH, BNB, USDT, USDC and Dai from the Horizon cross-chain bridge and now there’s evidence linking the heist to Lazarus, a hacking outfit linked to the North Korean government.
Elliptic, a London-based blockchain analysis firm, says the hackers have started moving funds through Tornado Cash, a mixer typically used to hide cryptocurrency transaction trails.
“The Horizon Bridge hacker has so far sent 41% of the $100 million in stolen crypto assets into the Tornado Cash mixer,” Elliptic said on Friday. “[We used our] Tornado demixing capability to trace all of the stolen funds through Tornado and onwards to other wallets,” the company added.
[ READ: U.S. Gov Blames North Korea Hackers for $600M Cryptocurrency Heist ]
Elliptic said there are “strong indications” that North Korea’s Lazarus Group may be responsible for this theft, based on the nature of the hack and the subsequent laundering of the stolen funds.
The Lazarus hackers have been linked to the theft of more than $2 billion in cryptocurrency assets from exchanges, and DeFi services.
The linking of Lazarus to this hack follows the U.S. government assessment in April that the North Koreans were responsible for a $600 million Ronin Validator cryptocurrency heist that is considered the second largest crypto theft of all time
The attribution was contained in a notice from the U.S. Treasury that announced sanctions against the Ethereum address that received the stolen funds.
[ READ: Hackers Steal Over $600M in Major Crypto Heist ]
According to new data from Elliptic, the thieves have already moved about $39 million through the Tornado mixer in an attempt to break the transaction trail back to the original theft. This makes it easier to cash out the funds at an exchange.
“The regularity of the deposits into Tornado over extended periods of time suggests that an automated process is being used. We have observed very similar programmatic laundering of funds stolen from the Ronin Bridge, which has been attributed to Lazarus, as well as a number of other attacks linked to the group,” Elliptic said.
State-backed North Korean hacking groups have been actively targeting cryptobanks and cryptocurrency exchanges with malware attacks with the Lazarus team conducting APT attacks since at least 2017.
The hacking teams in North Korea have also been seen targeting offensive security researchers and using a fake pen-test company in attacks that employ rich social engineering tactics. The APT group has also been caught sharing zero-day exploits for modern web browsers.
Related: Google Warning: North Korean Gov Hackers Targeting Security Researchers
Related: North Korea Gov Hackers Caught Sharing Chrome Zero-Day
Related: North Korean Hackers Back With Fake Pen-Test Company
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Backslash Snags $8M Seed Financing for AppSec Tech
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Aembit Scores $16.6M Seed Funding for Workload IAM Technology
- Project Zero: Samsung Mobile Chipsets Vulnerable to Baseband Code Execution Exploits
- Rapid7 Buys Anti-Ransomware Firm Minerva Labs for $38 Million
- Microsoft Pins Outlook Zero-Day Attacks on Russian Actor, Offers Detection Script
Latest News
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- Watch on Demand: Supply Chain & Third-Party Risk Summit Sessions
- TikTok CEO Grilled by Skeptical Lawmakers on Safety, Content
