Elliptic: Lazarus hackers returned to using Tornado Cash after blocking the Sinbad mixer

Hackers have started moving funds from the HTX crypto exchange hack into Tornado

15.03.2024 - 08:10

258

3 min

What’s new? Elliptic analysts have recorded the movement of funds related to the hack of the HTX exchange and its HECO cross-chain protocol. The attack, which experts attribute to the North Korean group Lazarus, caused the platforms to lose $100 million in November 2023. The stolen funds remained stationary for a long time, but on March 13, they began moving into the Tornado Cash crypto mixer, which was placed on a sanctions list by the US Treasury Department back in August 2022.

Elliptic’s report

What else is known? Following common cryptocurrency laundering schemes, immediately after the hack, the hackers exchanged the stolen tokens for ETH coins using decentralized exchanges (DEXs) but then suspended further transfers.

Lazarus then sent over $12 million to Tornado Cash in more than 40 transactions on March 13 and 14. The service was banned by US authorities for helping to launder $455 million stolen by Lazarus. In response, the group stopped using Tornado Cash and switched to using another crypto mixer called Sinbad.

Then in November 2023, the US Treasury Department banned Sinbad as well, also for its ties to DPRK hackers, eliminating its continued use by Lazarus.

Backdoor has been discovered in the Tornado Cash interface to intercept deposit data

According to community representatives, it has been functioning for two months

However, Elliptic notes that Tornado Cash continues to operate despite the sanctions. The service uses smart contracts on decentralized blockchains, so it can not be seized and shut down in the same way centralized mixers like Sinbad can.

“Lazarus Group now appear to have returned to using Tornado Cash as a way to launder funds at scale and obfuscate their transaction trail,” the company concluded.

In 2023, DPRK hackers carried out a record number of attacks on crypto projects. The damage in this case decreased in comparison with the record of 2022, amounting to just over $1 billion.

Later, the United States, South Korea, and Japan announced the beginning of joint development of measures to combat crypto hackers from the DPRK.

Author: