North Korean hackers stole at least $400 million in cryptocurrencies last year, according to an analysis of blockchain activity.
The estimate comes from Chainalysis, a firm that specializes in tracking cryptocurrency transactions. The company has also worked with law enforcement to hunt down cybercriminal suspects, and today it published a report documenting the cryptocurrency heists from a state-sponsored, North Korea-based hacking group called Lazarus.
“North Korean cybercriminals had a banner year in 2021, launching at least seven attacks on cryptocurrency platforms that extracted nearly $400 million worth of digital assets last year,” Chainalysis said.
Lazarus is perhaps best known for allegedly conducting the 2014 Sony Pictures hack, and the WannaCry ransomware outbreak of 2017. Since then, the group has also been spotted stealing hundreds of millions in cryptocurrencies, often from virtual exchanges and investment firms. The goal is to fund North Korea’s government and nuclear weapons programs, according to the United Nations.
“From 2020 to 2021, the number of North Korean-linked hacks jumped from four to seven, and the value extracted from these hacks grew by 40%,” Chainalysis added. One of the hacks involved cryptocurrency exchange Liquid.com, which lost $91.5 million to the group.
The report from Chainalysis found that overall only 20% of funds the North Koreans stole last year were made up of Bitcoin. The majority, at 58%, were Ether, while the remainder spanned both altcoins and ERC-20 tokens.
The North Korean hackers then laundered the stolen loot by “mixing” the funds through thousands of cryptocurrency addresses to obscure their origin. Once scrambled, the funds were exchanged into Bitcoin, which could be cashed out for fiat at Asia-based crypto exchanges.
By tracking the group’s heists, Chainalysis said it also uncovered several cryptocurrency wallets the North Korean hackers are using to stockpile a fortune. “Chainalysis has identified $170 million in current balances—representing the stolen funds of 49 separate hacks spanning from 2017 to 2021—that are controlled by North Korea but have yet to be laundered through services,” the company said.
“It’s unclear why the hackers would still be sitting on these funds, but it could be that they are hoping law enforcement interest in the cases will die down, so they can cash out without being watched,” Chainalysis added.
On Thursday, security firm Kaspersky also warned that North Korean hackers have been busy trying to steal from various companies that work with cryptocurrencies. To do so, the North Korean hackers have been impersonating venture capital companies and sending emails containing malware to potential victims.
“In some instances, the actors used a hacked account of a VC firm’s employee to have a conversation with the target,” the antivirus provider said. “Kaspersky researchers found more than 15 venture firms whose brand names and employee names were abused during the campaign.”
The North Korean hackers then used the malware to spy on victim computers before orchestrating a way to steal funds from their cryptocurrency wallets. This has included replacing browser extensions capable of managing cryptocurrency wallets with a malicious one.
“When the compromised user attempts to transfer funds to another account, the attackers intercept the transaction process and inject their own (computer) logic, changing the recipient’s address and maximizing the transaction amount, draining the account in one shot,” Kaspersky said.
