North Korea-Backed Lazarus Group Behind $305M DMM Bitcoin Heist: Report

The recent hack of Japanese crypto exchange DMM Bitcoin is reportedly having ties with the notorious North Korean Lazarus Group. According to on-chain sleuth ZachXBT, the heist is similar to the laundering techniques exhibited by the infamous Group.

“It is suspected that Lazarus Group is behind the hack due to similarities in laundering techniques and off chain indicators.”

1/4 So far in July 2024 more than $35M from the $305M DMM Bitcoin hack has been laundered to the online marketplace Huione Guarantee

It is suspected that Lazarus Group is behind the hack due to similarities in laundering techniques and off chain indicators. pic.twitter.com/g1ndlttBll

— ZachXBT (@zachxbt) July 14, 2024

On May 31, DMM Bitcoin lost 4,502.9 BTC ($305 million) to a hack, representing one of the largest global exchange hacks in terms of fiat value. The company confirmed that the attack was an “unauthorized leak of Bitcoin from our wallet.”

Per ZachXBT, the hackers sent the $305 million of stolen funds from DMM to an online marketplace – Huione Guarantee in July.

“Huione has become a major hub for illicit funds in South East Asia,” the investigator wrote on X. “Primarily being used by criminal organizations such as pig butchering gangs.”

4/4 Huione has become a major hub for illicit funds in South East Asia, primarily being used by criminal organizations such as pig butchering gangs.

A recent report by the blockchain analytics firm Elliptic revealed that merchants on the platform have done an estimated $11B+ in… https://t.co/n4E0rorhv9 pic.twitter.com/DJkweWYJPm

— ZachXBT (@zachxbt) July 14, 2024

Blockchain analytic firm Elliptic revealed recently that merchants on the marketplace offer “tech, data and money laundering services.” Apparently, they have engaged in transactions totaling at least $11 billion, the report noted.

Huione Guarantee is part of a Cambodian conglomerate Huione Group, with links to Cambodia’s ruling Hun family.

Tether Blacklists Wallet that Transferred $14M From DMM Bitcoin

Further, ZachXBT added that stablecoin issuer Tether has blocked a Tron-based wallet with 29.6 million USDT, apparently connected to Huione.

Besides, the wallet received $14 million worth hacked funds from the DMM Bitcoin in a 3-day period.

2/4 Over the weekend Tether blacklisted a wallet with 29.6M USDT on Tron connected to Huione.

~$14M flowed into this wallet from the DMM Bitcoin hack in a 3 day period.

TNVaKWQzau7xL9bcnvLmF9KSEQkWEs4Ug8 pic.twitter.com/dXfOBI9xkW

— ZachXBT (@zachxbt) July 14, 2024

Additionally, ZachXBT drew parallels between DMM breach and Lazarus Group’s previous operations and concluded a similar modus operandi.

The sleuth explained the sophisticated manner in which the stolen funds have been maneuvered across digital landscape. The suspected North Korean threat actors deposited the Bitcoins to mixer from the DMM hack, a Tweet read.

Later, after withdrawing BTC from the mixer, hackers bridged the funds across different blockchain networks, and converted it to other crypto denominations. This intricate heist strategy mirrors the signature laundering operations associated with the Lazarus Group.