Cambodian Payments Firm Helped Lazarus Group Launder $150,000 in Stolen Crypto

Cambodian currency exchange and payments company Huione Pay has been implicated in laundering over $150,000 in cryptocurrency stolen by the notorious North Korean hacking group Lazarus.

According to a Reuters report on Monday, the Phnom Penh-based company received the illicit funds between June last year and February this year, as revealed by blockchain data.

The stolen cryptocurrency was linked to hacks of three crypto firms conducted by Lazarus in June and July last year.

Huione Pay Says it Was Unaware of Receiving Stolen Funds

Huione Pay, in a statement, claimed it was unaware of receiving funds indirectly from the hacks.

CAMBODIA: It’s been a bad week for Huione, now @_tom_wilson_ for Reuters reports Huione received $150k+ from digital wallet used by North Korean hacking outfit Lazarus. Funds wre traced to a much larger theft of $160m from 3 crypto firms last year. 1/7 https://t.co/caFgORafMv

— CyberScamMonitor (@CyberScamWatch) July 15, 2024

Meanwhile, the National Bank of Cambodia (NBC) told Reuters that payments firms in the country are prohibited from dealing in cryptocurrencies and digital assets.

The ban, imposed in 2018, aims to mitigate risks associated with the volatility of cryptocurrencies, cybercrime, and the potential for money laundering and financing of terrorism.

The NBC indicated it might take corrective action against Huione Pay, though it did not specify any planned measures.

Despite the anonymity of cryptocurrency transactions, the blockchain’s public ledger allows tracking of movements from wallet to wallet.

U.S.-based blockchain analysis firm TRM Labs reported that Huione Pay was among several payment platforms and over-the-counter (OTC) brokers that received the majority of crypto stolen in the Atomic Wallet hack.

OTC brokers facilitate private crypto transactions, offering greater privacy than standard exchanges.

TRM Labs disclosed that the hackers employed a sophisticated laundering operation, converting the stolen cryptocurrency into various forms, including tether (USDT), a stablecoin pegged to the U.S. dollar.

They utilized the Tron blockchain, known for its speed and low transaction costs, to carry out these conversions.

Most of the laundered funds were sent to exchanges, services, and OTC brokers, including Huione Pay.

Scam Operators Flourish on Huione Guarantee

Huione Guarantee, an online marketplace operated by the Cambodian conglomerate Huione Group, has been involved in facilitating online scams in Southeast Asia.

As reported, the platform has facilitated transactions exceeding $11 billion, with a significant portion of these funds linked to money laundering and cyber scams, according to a recent research report by Elliptic.

Using blockchain analytics, the Elliptic research team was able to quantify the cryptocurrency transactions on the Huione Guarantee.

The marketplace primarily operates in Chinese and involves numerous instant messaging app channels, each managed by separate merchants.

These merchants offer various services that are fundamental to the operation of cyber scams.

It is worth noting that the cryptocurrency market has shown great resilience in the face of adversity, achieving a record recovery rate of 77% for stolen funds in the second quarter of 2024.

In Q2 2024, $347.4 million of the stolen crypto funds were successfully recovered or frozen out of the total $512.9 million lost, according to Hacken’s Web3 Security Report Q2 2024.

“For the second consecutive quarter, the silver lining amid the alarming rate of theft in crypto is the amount of funds recovered,” the report wrote.