A prolific North Korean state-sponsored hacking group has allegedly been implicated in recent attacks against Atomic Wallet customers, resulting in an estimated loss of $35 million.
The company, which offers a decentralized wallet that supports more than 500 coins and tokens, revealed over the weekend that some customers have complained of running out of funds.
For more information, see Lazarus: US imposes sanctions on three North Korean cyber groups.
Immediately after Information security Blockchain analytics firm Elliptic claimed that the trail of funds led to Lazarus, as it reported the first story.
“At Elliptic, we have identified the wallets of a number of victims and enabled our software to track stolen funds. We can identify any deposit.”
“Our investigative team also traces the transaction. An elliptical analysis of the thieves’ transactions led us to conclude with high confidence that this hack was perpetrated by North Korea’s Lazarus Group. .”
This attribution is based on several factors, but the most notable are:
- The process of laundering stolen cryptocurrencies follows the exact same set of steps used by Lazarus previously.
- Services used for asset laundering such as the Sinbad Mixer have also been used by Lazarus in the past.
- The stolen cryptocurrency may be combined with wallets that already hold digital money stolen from previous Lazarus robberies.
Elliptic claimed, if correct, that this would be the first time Lazarus has been publicly accused of cryptocurrency heist since he stole $100 million from Horizon Bridge in 2022.
North Korea’s state-sponsored hackers are unusual in that they focus not only on cyber espionage, but also on fundraising for the Kim Jong-un regime’s missile and nuclear programs.
A report earlier this week claimed that the country derives about 50% of its foreign currency earnings from such attacks. According to some estimates, billions of dollars may have been stolen in the last few years.
