Massive Ethereum Laundering Operation: North Korean Hackers Exploit Tornado Cash For $12M

In a recent development, North Korean hackers associated with the notorious Lazarus Group have exploited the coin-mixing service Tornado Cash to launder approximately $12 million worth of stolen Ethereum (ETH) within the past 24 hours. 

The incident follows the theft of $100 million in cryptocurrency from the HTX crypto exchange and its HECO Bridge in November 2023, attributed to the Lazarus Group by blockchain analytics firm Elliptic and other experts.

$100M Crypto Heist And Ethereum Laundering Uncovered

The Lazarus Group, a well-known cybercrime organization believed to be backed by the North Korean regime, has a long history of conducting high-profile hacking campaigns. 

According to Elliptic’s latest crypto crime report, in November 2023, the notorious Lazarus Group allegedly orchestrated a major heist targeting the HTX crypto exchange and its cross-chain bridge, resulting in the theft of $100 million in various cryptocurrencies, including Ethereum. 

Evidence gathered by Elliptic and other experts pointed to the involvement of the Lazarus Group based on the modus operandi and subsequent movement of the stolen funds.

The investigation further notes that, following their “usual pattern” of crypto-laundering, the hackers quickly converted the stolen tokens into Ethereum through decentralized exchanges (DEXs). 

These illicitly acquired Ethereum funds remained dormant until recently, on March 13, when the hackers began funneling them through Tornado Cash. Tornado Cash is a decentralized, smart contract-based mixer previously sanctioned by the US Treasury in August 2022 for its association with laundering $455 million from the Lazarus Group crypto hacks.

However, the decentralized nature of Tornado Cash’s operations has prevented it from being shut down like centralized mixers like Sinbad.io.

The Last Resort For Lazarus Group

According to the blockchain analytics firm, in response to the sanctions imposed on Tornado Cash, the Lazarus Group shifted its focus to using cross-chain bridges and the Bitcoin-based mixer Sinbad.io as an alternative. 

However, in November 2023, Sinbad.io itself was seized by US authorities, eliminating another commingling option for the hackers. As a result, the group appears to have returned to Tornado Cash, using its decentralized architecture and resistance to raids to launder funds at scale and obscure its transaction trail.

Ultimately, Elliptic suggests that the resurgence of the Lazarus Group’s reliance on Tornado Cash can be attributed to the “diminishing availability” of large-scale mixers due to law enforcement operations targeting services like Sinbad.io and Blender.io. 

With fewer viable alternatives, the group has capitalized on Tornado Cash’s continued operation despite sanctions, exploiting smart contracts’ security and decentralized nature on blockchain networks.

As of the time of writing, Ethereum is currently trading at $3,870. Earlier this week, it reached a two-year high of $4,084; however, it failed to sustain consolidation above this level. Consequently, over the past 24 hours, ETH has experienced a 2.5% decline in price.

Featured image from Shutterstock, chart from TradingView.com