North Korean hacker accused of being behind Harmony’s Horizon bridge hack

North Korean cybercriminals have once again shaken the crypto market as they are believed to have been behind the latest hack of Harmony’s Horizon bridge.

According to new analysis by blockchain research firm Elliptic, Lazarus Group, a North Korea-related hacker group believed to be backed by the Pyongyang Government, is likely behind Harmony’s Horizon Bridge hack last week.

There are strong indications that North Korea’s Lazarus Group may be responsible for the $100 million Harmony heist | 41% of the stolen cryptoassets have been moved through the Tornado Cash mixer | Read our analysis:https://t.co/CoS2Ozu0WG

— elliptic (@elliptic) June 29, 2022

Elliptic reported that on the morning of June 24, more than $100 million in cryptocurrency was stolen from Horizon Bridge, a service that allows transferring assets between the Harmony blockchain and other blockchains. The cryptocurrencies stolen include Ethereum (ETH), Tether (USDT), Wrapped Bitcoin (WBTC), and BNB.

The attacker immediately used the Uniswap DEX exchange to convert most of these assets into 85,837 ETH. This is a common washing technique used to avoid confiscation of stolen property.

They then quickly converted the stolen assets into 85,837 ETH and started sending some ETH through Tornado Cash, a popular crypto mixer commonly used to launder the obtained cryptos legal. To date, about 35,000 ETH, or about 41% of the total value appropriated by Lazarus Group, has been sent to Tornado Cash.

Elliptic’s analysis of the Harmony hack and the money laundering process also shows that this form is fully consistent with Lazarus Group’s past activities. Although no single factor has proven Lazarus’ involvement, the combination has produced a credible chain of factual evidence.

The Harmony Bridge hack is very similar to other hacks perpetrated by the Lazarus Group, including the Ronin Bridge hack that cost $622 million in March 2022, making it the largest hack in the history of the crypto industry. The key factor that accused Lazarus Group was largely due to the deposit of Tornado Cash, imitation of Ronin money laundering, as well as the timing of the attack at night in Asia.

– See more: Top 5 most serious attacks in the history of the cryptocurrency market – Ronin Network’s sad record

On the Harmony side, the project has also sent a direct notice to the hacker behind the attack that Harmony will deploy an investigation plan in coordination with many other functional parties, even “handling” the law if necessary to find out the truth of who is behind the incident.

2/ We are providing one FINAL opportunity for the actor(s) to return stolen assets with anonymity. Our FINAL term is below.

— Harmony (@harmonyprotocol) June 30, 2022

In addition, Harmony made a negotiated offer allowing the hacker to keep $10 million and then voluntarily return $90 million of the stolen money. The Harmony refund period is also specified to last until 23:00 (GMT) on July 4, 2022.

4/ To the responsible actor: We are giving you until Monday, July 4th, 23:00 GMT to initiate communication.

— Harmony (@harmonyprotocol) June 30, 2022

Finally, the project has publicly provided a wallet address for hackers to send money back and confirmed to continuously update the community in the near future.

7/ Harmony has sent one last transaction to the primary wallet holding stolen funds as an additional effort to communicate. Our Medium article reflects this latest update.https://t.co/Rapxv3Rgyz

— Harmony (@harmonyprotocol) June 30, 2022

However, at any rate, through the above developments, it can be affirmed that North Korean hackers are really a growing threat to the crypto market in general. In 2021, North Korean cybercriminals stole up to $400 million in crypto, mostly ETH. Going back to recent times, $1.7 billion has “failed” since the beginning of 2022, 97% comes from the DeFi segment and most of it comes from Lazarus Group.

Even the activities of this hacker group have gradually grown so sophisticated that the US has to issue a warning to prevent North Koreans from impersonating their nationality to “attack” the technology sector, especially crypto.

Synthetic CHK

Maybe you are interested: