Analysis of the Lazarus Group's Crypto Assets Theft and Money Laundering Activities

A recent confidential report from the United Nations reveals that the North Korean hacker group Lazarus Group stole funds from a Crypto Assets exchange last year and laundered $147.5 million through a certain virtual currency platform in March this year.

The United Nations Security Council's sanctions committee monitors are investigating 97 suspected cyber attacks by North Korean hackers targeting Crypto Assets companies that occurred between 2017 and 2024, involving approximately $3.6 billion. This includes an attack on a certain Crypto Assets exchange at the end of last year, resulting in a loss of $147.5 million, which was completed with Money Laundering in March this year.

A certain government's sanctions were imposed on the virtual currency platform in 2022. In 2023, two co-founders of the platform were accused of assisting in Money Laundering over $1 billion, with some of the funds linked to North Korean cyber crime organizations.

According to a survey by cryptocurrency analysis experts, the Lazarus Group laundered $200 million worth of crypto assets into fiat currency between August 2020 and October 2023.

The Lazarus Group has long been accused of conducting large-scale cyberattacks and financial crimes, targeting various industries around the world. The following will analyze several typical cases, revealing how the organization implements attacks through complex strategies and technical means.

Social Engineering and Phishing Attacks of the Lazarus Group

According to European media reports, Lazarus previously targeted military and aerospace companies in Europe and the Middle East. They posted fake job advertisements on social media platforms to lure job seekers into downloading PDF files containing malware, thereby carrying out phishing attacks.

These social engineering and phishing attacks exploit psychological manipulation to deceive victims into lowering their guard and performing dangerous actions such as clicking links or downloading files. Their malware can exploit vulnerabilities in the affected systems to steal sensitive information.

Lazarus used similar tactics in a six-month operation against a certain Crypto Assets payment provider, resulting in the company being robbed of $37 million. Throughout the process, they sent fake job opportunities to engineers, launched distributed denial-of-service attacks, and attempted to brute-force passwords.

Multiple Crypto Assets Exchange Attack Incidents

From August to October 2020, multiple cryptocurrency exchanges were attacked:

• On August 24, a wallet from a Canadian exchange was hacked.
• On September 11, a project experienced an unauthorized transfer of $400,000 from the team wallet due to a private key leak.
• On October 6th, a certain exchange's hot wallet was exploited due to a security vulnerability, resulting in the transfer of $750,000 in crypto assets.

The stolen funds were consolidated to the same address in early 2021 and then laundered through a certain mixing service. The attackers transferred and exchanged the funds multiple times before finally sending them to a specific deposit address.

Well-known project founder遭Hacker攻击

On December 14, 2020, the personal wallet of the founder of a mutual insurance project was hacked, resulting in the theft of 370,000 tokens (worth 8.3 million USD). The stolen funds were transferred across multiple addresses and exchanged for other assets. The attacker obscured the source of the funds through cross-chain operations, mixing platforms, and multiple transfers.

From May to July 2021, the attacker transferred 11 million USDT to a certain trading platform. From February to June 2023, they sent a total of 11.17 million USDT in batches to two different deposit addresses.

Recent Attack Incident Analysis

In August 2023, a total of 1524 ETH was transferred to a certain coin mixing service during two different attack incidents. Subsequently, the funds were withdrawn to several intermediary addresses and eventually sent to a specific deposit address after exchange in November.

Summary

The main money laundering methods of the Lazarus Group include:

1. Cross-chain transfer
2. Use Mixing Services
3. Multiple Transfers and Exchanges
4. Finally, gather the funds to a fixed address group for withdrawal.

These continuous, large-scale attacks pose a significant security threat to the Web3 industry. Relevant institutions are continuously tracking the dynamics and money laundering methods of this hacker group in order to assist in combating such crimes and recovering stolen assets.