North Korean hackers launder $27M ETH from Harmony Bridge attack

North Korean exploiters behind the Harmony Bridge attack continue to launder funds stolen in June 2022. The perpetrators moved an additional $27.18 million in Ethereum (ETH) over the weekend, according to on-chain data revealed by blockchain research firm ZachXBT on Jan. 28.

The token has been transferred to 6 different crypto exchanges. I got it I used ZachXBT in a Twitter thread without disclosing which platform received the token. Three primary addresses performed transactions.

According to ZachXBT, exchanges have been notified of the funds transfer and have frozen some of the stolen assets. A cryptocurrency sleuth noted that the rogue’s move to launder money is very similar to his January 13th move, where more than $60 million was laundered.

Who are the active rn?

DPRK has completed laundering an additional $17.7 million (11304 ETH) from the Harmony Bridge hack.

Send the S/O to the exchanges that responded quickly over the weekend as the funds could be frozen. pic.twitter.com/sUyUScHR4N

ZachXBT (@zachxbt) January 29, 2023

The funds were moved days after the Federal Bureau of Investigation (FBI) identified Lazarus Group and APT38 as the criminals behind the $100 million hack. In a statement, the FBI said, “Through our investigation, North Korea-linked cyber actors Lazarus Group and his APT38 were implicated in the theft of his $100 million cryptocurrency from Harmony’s Horizon Bridge. I was able to confirm that there is,” he said.

RELATED: ‘Nobody’s Holding Them Down’ North Korea Cyber Attack Threat Increases

Harmony Bridge facilitates transfers between Harmony and the Ethereum network, Binance Chain, and Bitcoin. About $100 million worth of tokens were stolen from the platform on June 23rd.

After the exploit, 85,700 Ether was processed through the Tornado Cash Mixer and deposited to multiple addresses. On January 13th, the hacker began transferring stolen funds worth approximately $60 million via his Ethereum-based privacy protocol RAILGUN. An analysis by crypto-tracking platform MistTrack found that 350 addresses were linked to the attack through a number of exchanges to avoid identification.

Lazarus is a well-known hacking syndicate responsible for many significant crypto industry breaches, including the $600 million Ronin Bridge hack last March.