Elliptic: Lazarus Group taps Tornado Cash to launder Heco Bridge, HTX hack proceeds

North Korea’s hacker organization Lazarus is using Tornado Cash again despite U.S. sanctions against the popular cryptocurrency mixer. 

Blockchain analytics startup Elliptic reported on March 14 that Lazarus funneled $12 million into the Ethereum-based crypto tumbler. The funds, denominated in Ether (ETH), originated from a November hack on Justin Sun’s HTX and the exchange’s cross-chain solution, Heco Bridge. 

According to Elliptic and several other on-chain security firms, Lazarus orchestrated a $100 million attack on the two platforms last year. The funds remained dormant until March 13, when North Korea’s infamous hacker group began laundering stolen HTX assets. 

According to Elliptic, Lazarus has made over 40 transactions into the smart-contract-based mixer in the last 24 hours. 

For years, the criminal organization frequently used Tornado Cash to obscure transactions and launder illicit wealth until U.S. authorities sanctioned the service in August 2022. However, due to its decentralized design, Tornado Cash continued to operate since the government could not effect a total shutdown. 

U.S. agencies targeted other Lazarus Group options like Bitcoin-based mixers Blender and Sinbad in response. These platforms differ from Tornado Cash, as developers utilized a centralized model for the design. This meant that law enforcement was able to shutter the services completely. 

As crypto.news reported, citing Chainalysis data, the crackdown resulted in a 29% reduction in crypto money laundering throughout 2023, as Lazarus and other bad actors struggled to off-ramp looted funds. 

However, the North Korean syndicate’s return to Tornado Cash signals a scarcity of large-scale mixers, mainly due to U.S. enforcement action and regulatory takedowns.