Lazarus Group Suspected in Massive $305 Million Crypto Heist

Lazarus Linked to DMM Bitcoin Hack

The recent hack of Japanese crypto exchange DMM Bitcoin has been linked to the notorious North Korean Lazarus Group, according to on-chain investigator ZachXBT. The heist shares striking similarities with the laundering techniques typically used by the group.

“It is suspected that Lazarus Group is behind the hack due to similarities in laundering techniques and off-chain indicators,” ZachXBT noted.

On May 31, DMM Bitcoin reported the loss of 4,502.9 BTC, valued at $305 million, marking one of the largest global exchange hacks in terms of fiat value. The company confirmed the attack as an “unauthorized leak of Bitcoin from our wallet.”

Per ZachXBT, the stolen $305 million was sent from DMM Bitcoin to an online marketplace, Huione Guarantee, in July.

“Huione has become a major hub for illicit funds in Southeast Asia,” ZachXBT wrote on X. “Primarily being used by criminal organizations such as pig butchering gangs.”

Blockchain analytics firm Elliptic recently revealed that merchants on the marketplace offer “tech, data, and money laundering services,” with transactions totaling at least $11 billion. The report noted that Huione Guarantee is part of a Cambodian conglomerate, Huione Group, which has ties to Cambodia’s ruling Hun family.

Tether Blacklists Wallet Involved in the Heist

Additionally, ZachXBT reported that stablecoin issuer Tether has blacklisted a Tron-based wallet with 29.6 million USDT linked to Huione. This wallet received $14 million of the hacked funds from DMM Bitcoin over a three-day period.

ZachXBT drew parallels between the DMM Bitcoin breach and previous Lazarus Group operations, concluding a similar modus operandi. The group allegedly maneuvered the stolen funds through mixers, then bridged them across different blockchain networks and converted them to other cryptocurrencies. This intricate strategy mirrors the signature laundering operations associated with the Lazarus Group.