Lazarus Group allegedly moves stolen funds from $308m DMM Bitcoin hack

by

As a seasoned researcher with extensive experience in blockchain forensics and investigating cryptocurrency hacks, I find the recent developments surrounding the $308 million heist from DMM Bitcoin deeply concerning. The fact that over $35 million of the stolen funds have been laundered through Huione Guarantee, an online marketplace based in Cambodia, raises serious questions about the role this company plays in facilitating illicit activities.

Criminals behind the $308 million cryptocurrency theft from DMM Bitcoin in May have successfully laundered around $35 million of the ill-gotten gains through a popular online marketplace based in Cambodia as of this month, uncovered by blockchain analyst ZachXBT.

As a researcher, I’ve come across ZachXBT’s report indicating that certain funds were transferred to Huione Guarantee, a Cambodian organization believed to have ties with the Hun family, as suggested in Elliptic’s July 10 post based on blockchain forensics.

Approximately 12.5% of the $305M stolen during the DMM Bitcoin heist in July 2024, amounting to over $35M, has been traced and cleaned up through Huione Guarantee, an online marketplace. The laundering activities are believed to be the work of Lazarus Group due to shared techniques and hidden indicators outside of the blockchain.

— ZachXBT (@zachxbt) July 14, 2024

Elliptic reports that about $11 billion in crypto transactions on the marketplace can be traced back to hacks, pig butchering scams, and illegal activities.)

I, as a researcher, propose that the Lazarus Group could be behind the recent hack based on certain similarities in money laundering methods and other off-the-chain indicators suggested by ZachXBT.

Based on the investigation conducted by blockchain detectives, the stolen Bitcoins are believed to have been moved to privacy mixers for concealment. Subsequently, they were taken out and shifted to Ethereum or Avalanche networks through THORChain’s cross-chain liquidity protocol.

With my deep-rooted understanding of digital currencies and their respective platforms, I can tell you this: The funds are transformed into USDT, the stablecoin of Tether, and subsequently forwarded to Tron’s network. Once they reach Tron, they are then transferred onward to Huione.

On July 12, Tether took action to block a transfer of approximately $28.2 million from being sent to Huione, by adding the Tron wallet address “TNVaK…s4Ug8” to its blacklist. This address had been identified as having previously moved around $14 million in connection with the DMM Bitcoin hack, as reported by ZachXBT.

ZachXBT has revealed over 500 wallet addresses that can be traced back to the Lazarus Group, Huione, and other entities implicated in the DMM Bitcoin heist.

On May 30, a major breach in the security of Japan’s DMM Bitcoin led to an unauthorized intrusion and the theft of approximately $308 million worth of Bitcoin. This unfortunate incident was caused by a crucial vulnerability that was successfully exploited.

As an analyst, I’ve come across some concerning reports about Huione Guarantee. According to the information available, this company has apparently transformed into a hub for fraudulent activities in the Southeast Asian region. It’s believed that Huione Guarantee serves as a deposit and escrow service for peer-to-peer transactions on Telegram, primarily utilizing Tether’s USDT stablecoin. This arrangement seems to be enticing for scammers and money launderers due to its inherent anonymity and ease of use.

Additionally, the blockchain investigation company has claimed that Huione Guarantee may be connected to Cambodia’s powerful political figures, specifically Prime Minister Hun Manet and his family.

As a crypto investor, I’ve come to learn that law enforcement and blockchain analysts are taking action in response to the recent findings regarding Huione’s suspected illicit activities. To put a stop to these operations, they’re closely monitoring transactions on the cryptocurrency network and working diligently to identify wallets linked to Huione’s platform.

Read More

2024-07-15 11:50