North Korean hackers actively launder Stake’s $3.6m
North Korea’s hackers are using intermediaries, a cross-chain bridge and at least one centralized exchange to launder $3.6 million in stolen crypto.
The North Korea-affiliated Lazarus Group sent a lightly over 2,227 ETH (valued at ~$3.6 million as of press time) to two intermediary addresses in an effort to cover its tracks.
According to an X post published by PeckShieldAlert, the intermediaries have sent over 11,000 in ETH to Swft Blockchain, cross-chain swap protocol. For some unknown reason the intermediaries have also sent around $4,560 in ETH to Binance, a centralized cryptocurrency exchange.
Most of the stolen crypto was swapped for at least 80 BTC (worth ~$2.16 million) and then bridged to the Bitcoin network via THORChain, a cross-chain bridge enabling swaps without wrapped or pegged assets.
PeckShield says one of the intermediary addresses is still in the process of laundering funds as it has received another 1,390 ETH (worth around $2.28 million).
In the meantime, the hackers also transferred around 59,500 BNB (worth $12.5 million) in stolen crypto from Stake.com on BNB Chain (formerly Binance Smart Chain) to an intermediary address. The funds were later sent to BSC Token Hub, a bridge between BNB Beacon Chain (BEP2) and BNB Chain (BEP20).
The remaining funds were either laundered via Tornado Cash or sent to centralized exchanges, including OKX, ChangeNow and Binance, PeckShield said.
In early September, Stake.com, a crypto-based sports betting and casino platform, suffered a hack that led to $40 million in cryptocurrency theft. The FBI later attributed the attack to Lazarus Group.
