In March 2022, the Lazarus Group, a hacking group backed by North Korea, stole approximately $5.84 million worth of cryptocurrency through the hack of the Axie Infinity Ronin Bridge. However, 10 months later, the Norwegian Police Service Økokrim announced that the stolen funds had been seized.
Criminal Investigation Units have been able to track money on the blockchain even when criminals use sophisticated technology. They worked closely with international law enforcement partners to disrupt money laundering activities and trace the tracing of money by criminals who may have potentially supported North Korea’s nuclear weapons program.
Additionally, blockchain analytics firm Elliptic reported that cryptocurrency exchanges Binance and Huobi froze accounts containing approximately $1.4 million in digital currency stemming from Harmony’s Horizon Bridge hack in June 2022. The hack is also attributed to the Lazarus Group, which laundered some of the stolen money through Tornado Cash, which was sanctioned by the US government in August 2022. Elliptic’s Tom Robinson argued that Blender, another cryptocurrency mixer that was sanctioned in May 2022, may have re-emerged as Sinbad. , laundered nearly $100 million worth of Bitcoin in the hack of the Lazarus Group. Evidence suggests that Sinbad is a rebrand of Blender due to overlapping wallet addresses used, connections to Russia, and how the two mixers work.
The Lazarus Group’s financially motivated attacks continue to fund other cyber activities, including espionage against defense industries and defense-industry-based organizations in South Korea and the United States. These findings are particularly concerning as healthcare organizations are facing a new wave of ransomware attacks organized by the group. Despite police efforts, the Lazarus Group’s attacks continue to evolve with new behaviors using anti-forensic techniques to obliterate intrusion and impede analysis.