An investigative report by crypto sleuth ZachXBT revealed that the North Korean Lazarus Group laundered over $200 million worth of stolen cryptocurrency into fiat currency between August 2020 and October 2023. The investigation uncovered over 25 exploits across various blockchains and traced the illicitly gained funds through mixers, peer-to-peer marketplaces, and centralized exchanges. The Lazarus Group, infamous for its cyberattacks since emerging in 2009, has reportedly stolen over $3 billion in crypto assets over the years, impacting thousands of people in the space directly and indirectly.
The stolen digital assets were allegedly laundered by the Lazarus Group using a combination of crypto mixing services and peer-to-peer (P2P) marketplaces. A significant portion of the stolen cryptocurrency, at least $44 million, was laundered through P2P marketplaces like Paxul and Noones, utilizing usernames consistent with the movement of stolen funds. The hacked funds were mainly converted into the USDT stablecoin before being exchanged for fiat currencies and withdrawn. The Lazarus Group historically relied on over-the-counter traders in China to convert cryptocurrency into fiat currencies.
Tether blacklisted over $374,000 worth of stolen funds associated with the Lazarus Group in November 2023. Three out of four stablecoin issuers also reportedly blacklisted an additional $3.4 million sitting in a cluster of addresses linked to Lazarus. Data from the United Nations Security Council (UNSC) and DeFiLlama show that North Korea was involved in crypto heists amounting to approximately $2.4 billion since 2020, with $1.69 billion attributed to thefts resulting from compromised private keys.
A report by the UNSC documented 58 crypto heists with suspected North Korean involvement dating back to 2017, totaling approximately $3 billion in stolen funds. Chainalysis reported a higher figure in January, estimating that North Korea-linked hacks accounted for $1 billion of the $1.7 billion total stolen in 2020. Despite increased activity by North Korean hackers in 2023, they absconded $700 million less than the preceding year. Overall, approximately $1.7 billion worth of funds were stolen from the cryptocurrency space across 231 hacks in recent years.
Analysis of DeFiLlama and UNSC data revealed a decline in the overall amount of crypto hacked from protocols, dropping to $1.53 billion in 2023 from $3.28 billion in 2022. This decline could suggest project security improvements or be influenced by market conditions. However, experts caution that hacking volume may surge again with favorable market conditions and the continued growth of the decentralized finance (DeFi) sector. The North Korean Lazarus Group’s involvement in laundering stolen cryptocurrency highlights the ongoing challenges of cybersecurity and the need for increased vigilance in the crypto space.
