Norway Seizes $5.84 Million in Cryptocurrency Stolen by Lazarus Hackers

Norwegian police agency Økokrim has announced the seizure of 60
million NOK (about $5.84 million) worth of cryptocurrency stolen by
the Lazarus Group in March 2022 following the Axie Infinity Ronin
Bridge hack.

“This case shows that we also have a great capacity to follow
the money on the blockchain, even if the criminals use advanced
methods,” the agency said^[1]
in a statement.

The development comes more than 10 months after the U.S.
Treasury Department implicated^[2]
the North Korea-backed hacking group for the theft of $620 million
from the Ronin cross-chain bridge.

Then in September 2022, the U.S. government announced^[3]
the recovery of more than $30 million worth of cryptocurrency,
representing 10% of the stolen funds.

Økokrim said it worked with international law enforcement
partners to follow and piece together the money trail, thereby
making it more difficult for criminal actors to carry out money
laundering activities.

“This is money that can support North Korea and their nuclear
weapons programme,” it further added. “It has therefore been
important to track the cryptocurrency and try to stop the money
when they try to withdraw it in physical assets.”

The development comes as crypto exchanges Binance and Huobi
froze accounts containing approximately $1.4 million in digital
currency that originated from the June 2022 hack of Harmony’s Horizon Bridge^[4].

The attack, also blamed on the Lazarus Group^[5], enabled the threat
actors to launder some of the proceeds through Tornado Cash, which
was sanctioned^[6]
by the U.S. government in August 2022.

“The stolen funds remained dormant until recently, when our
investigators began to see them funneled through complex chains of
transactions, to exchanges,” blockchain analytics firm Elliptic
said^[7]
last week.

What’s more, there are indications that Blender^[8]
– another cryptocurrency mixer that was sanctioned in May 2022 –
may have resurrected as Sinbad, laundering nearly $100 million in
Bitcoin from hacks attributed to the Lazarus Group, Elliptic’s Tom
Robinson told The Hacker News.

According to the company^[9], funds siphoned in the
wake of the Horizon Bridge heist were “laundered through a complex
series of transactions involving exchanges, cross-chain bridges and
mixers.”

“Tornado Cash was used once again, but in place of Blender,
another Bitcoin mixer was used: Sinbad.”

Although the service launched only in early October 2022, it is
estimated to have facilitated tens of millions of dollars from
Horizon and other North Korea-linked hacks.

In the two-month period ranging from December 2022 to January
2023, the nation-state group has sent a total of 1,429.6 Bitcoin
worth approximately $24.2 million to the mixer, Chainalysis
revealed^[10] earlier this month.

The evidence that Sinbad is “highly likely” a rebrand of Blender
stems from overlaps in the wallet address used, their nexus to
Russia, and commonalities in the way both the mixers operate.

“Analysis of blockchain transactions shows that a Bitcoin wallet
used to pay individuals who promoted Sinbad, itself received
Bitcoin from the suspected Blender operator wallet,” Elliptic
said.

“Analysis of blockchain transactions shows that almost all of
the early incoming transactions to Sinbad (some $22 million)
originated from the suspected Blender operator wallet.”

Sinbad’s creator, who goes by the alias “Mehdi,” told WIRED^[11] that the service was
launched in response to “growing centralization of cryptocurrency”
and that it’s a legitimate legitimate privacy-preserving project
along the lines of Monero, Zcash, Wasabi, and Tor.

The findings also arrive as healthcare entities are in the
crosshairs of a new wave of ransomware attacks orchestrated by the
Lazarus actors to generate illicit revenue for the sanctions-hit
nation.

Profits made from these financially motivated attacks are used
to fund other cyber activities that include spying on defense
sector and defense industrial base organizations in South Korea and
the U.S., per a joint advisory^[12] issued by the two
countries.

But the law enforcement actions are yet to put a dampener on the
threat actor’s prolific attack spree, which has continued to evolve
with new behaviors.

This comprises a wide range of anti-forensic techniques that are
designed to erase traces of the intrusions as well as obstruct
analysis, AhnLab Security Emergency response Center (ASEC)
disclosed in a recent report.

“The Lazarus group performed a total of three techniques: data
hiding, artifact wiping, and trail obfuscation,” ASEC researchers
said^[13].