In what security experts call for the largest violation of the Blockchain transactions history, the FBI confirmed that the Lazare group supported by the state of North Korea orchestrated the massive flight of $ 1.5 billion in the cryptocurrency exchange at the beginning of the month.
The pirates, also known as the Traderraitor, have already started to whiten stolen assets, to convert portions into Bitcoin and to disperse funds over thousands of addresses on several blockchains, according to a public service announcement from the FBI published on Wednesday.
“The actors of Traderraitor take place quickly,” said the FBI. “We expect these assets to be more bleached and ultimately converted into fiduciary currency.”
The attack of February 21 mainly targeted Ethereum Holdings, including eth to liquid tokens, with around 499,000 stolen ethics. The blockchain analysis company, Spotonchain, reports that the pirates have already whitened around 100,000 ETH (around 250 million dollars) in less than four days, representing approximately 20% of the stolen funds.
Sophisticated attack methodology
According to Manuel Villegas, analyst at Julius Baer, the violation involved a very sophisticated approach targeting cold wallets. “The attackers created a false interface that deceives users, because it is an almost identical copy of the trust platform,” said Villegas.
Bybit confirmed that an Ethereum routine transfer from an offline “cold” portfolio was handled by attackers who redirected cryptocurrency to unidentified addresses. Safe, the multisig portfolio supplier involved, said that “a developer machine has been compromised, allowing hackers to deceive owners of a multisig cold wallet in the signing of a malicious transaction.”
Industry is mobilizing against pirates
The CEO of Bybit, Ben Zhou, joined the cryptography community to join what he called a “war against Lazarus”, launching a bonus site offering $ 140 million in rewards to follow the stolen crypto and include it by other exchanges.
“We will not stop until Lazarus or the bad players in the industry are not eliminated,” said Zhou on the social media platform X.
The FBI has published a list of 51 Ethereum addresses linked to the attack and urged exchanges, node operators and other participants in the industry to block transactions linked to these addresses. The Blockchain Elliptic analysis company has already reported more than 11,000 portfolio addresses suspected of being connected to the incident.
The growing cyber-man of North Korea
This attack highlights the growing use of cybercrime by North Korea to finance state operations in the midst of international sanctions. According to the South Korea intelligence agency, North Korea has stolen from around $ 1.2 billion in cryptocurrency and other virtual assets in the past five years.
A panel of UN experts is currently investigating 58 north-Korean cyber attacks alleged between 2017 and 2023 which brought in around $ 3 billion, helping to finance the country’s weapon development programs.
The Heist 2024 far exceeds previous attacks, the North Korean pirates flying more than $ 1.3 billion in digital assets this year, against $ 660 million in 2023.
Market impact
The flight contributed to the recent downward pressure on the prices of cryptocurrencies, Bitcoin exchanging about $ 82,000 on Thursday, compared to summits of more than $ 100,000 a month ago.
Despite the attack, the United Arab Emirates, where the appeal holds regulatory approvals, continued to support the operations of the exchange in the country. Dubai has become a hub for cryptocurrency companies and investors, water receiving more than $ 30 billion in cryptographic transactions between July 2023 and June 2024, according to the Chainalysis blockchain analysis company.
Robin Hanten
Finance and business analyst
Robin Hanten
Finance and business analyst
Writer and cryptocurrency and trading publisher, I specialize in algorithmic trade. I wrote on all types of automated trading tools – cryptocurrency robots and robots of binary options, up to Robo Advisors. My goal is to write honest criticism on automated trading tools to help users understand which software is trustworthy and which
