North Korea's Lazarus Group Moves $1.2M Bitcoin From Coin Mixer to Holding Wallet

Last updated: January 8, 2024 01:36 EST . 2 min read

Disclosure: Crypto is a high-risk asset class. This article is provided for informational purposes and does not constitute investment advice. By using this website, you agree to our terms and conditions. We may utilise affiliate links within our content, and receive commission.Source: AdobeStockNorth Korea-sponsored hacking syndicate Lazarus Group has transferred $1.2 million worth of cryptocurrency from a mixer, marking their largest transaction in over a month.

In a post on X (formerly Twitter) on January 8, blockchain analysis firm Arkham reported that the Lazarus Group processed the transaction by moving the assets from a coin mixer to a holding wallet.

gm

The Lazarus Group just made its biggest transactions in over a month, withdrawing $1M in BTC from what appears to be a mixing service this morning, then sending $150K of that to an inactive address they’ve sent to before.

Track Lazarus on Arkham: pic.twitter.com/quYYF3h7Dj

— Arkham (@ArkhamIntel) January 8, 2024

Additional data revealed that the wallet received 27.371 BTC in two transactions before sending out 3.34 BTC to a previously used wallet. However, the specific coin mixer used in this transaction was not identified.

According to Arkham, the Lazarus Group maintains $79.6 million across ious crypto portfolios, including BTC and ETH, worth $45K and $2K, respectively.

Source: Arkham Portfolio TrackerA mixing service, also known as a coin mixer or tumbler, is a blockchain-based protocol designed to obscure the ownership of cryptocurrencies. It achieves this by combining the coins with those from other users before redistributing them, making it challenging to trace the origin and recipients of the funds.

Lazarus Group: The North Korea Crypto Theft Syndicate

In a November 2023 data report, Recorded Future’s Insikt Group highlighted a substantial increase in North Korea’s focus on the cryptocurrency industry, estimating a staggering $3 billion in digital assets theft.

The 15-page report revealed that the hacker group’s illicit activities originated in 2017 within the South Korean market and subsequently expanded globally.

In 2022, the North Korean threat actors were accused of stealing $1.7 billion in cryptocurrency – equivalent to 5% of the country’s economy or 45% of its military budget.

Source: Recorded Future ReportThe stolen funds, often laundered through methods similar to traditional cybercriminal groups, serve as a crucial revenue source for the Korean government. This has reportedly enabled North Korea to sustain its operations despite facing international sanctions.

Furthermore, a report released by TRM Labs on January 5, 2024, revealed that the Lazarus Group might have absconded with up to $700 million in cryptocurrency in 2023, with $600 million confirmed through their research.

The blockchain firm highlighted that the Democratic People’s Republic of Korea (DPRK) constantly adapts its money laundering methods to evade international law enforcement pressure.

Research findings indicate that the hackers typically compromise users’ private keys or seed phrases, transferring the funds to wallets controlled by the DPRK. Subsequently, the assets are exchanged for other cryptocurrencies.

Despite advancements in cybersecurity among exchanges and heightened international collaboration in tracking and recovering stolen funds, TRM Labs predicts that 2024 will likely witness further disruptions from one of the world’s most prolific cyber-thieves.