North Korean-funded hackers were likely the perpetrators of the Horizon hack that led to the theft of approximately $100 million in cryptocurrency, according to an analysis by blockchain researchers.
See also: OpenSea reveals data breach – warns of phishing attacks
The hackers targeted Horizon, a so-called blockchain bridge developed by American crypto start-up Horizon. The tool is used by crypto traders to exchange tokens between different networks.
There is “strong evidence” that the Lazarus Group, a hacking group with strong ties to Pyongyang, orchestrated the attack, blockchain analytics firm Elliptic said in a post on Wednesday.
Most of the funds were immediately converted to the cryptocurrency ether, Elliptic said. The company added that the hackers have begun laundering the stolen assets through Tornado Cash, a so-called “mixing” service that seeks to hide the tracks of the funds. So far, about $39 million in ether has been sent to Tornado Cash.
Elliptic says it used “demixing” tools to trace stolen cryptocurrency sent via Tornado Cash to several new ether wallets. Chainalysis, another blockchain working with Harmony to investigate the hack, supported the findings.
According to the companies, the manner in which the attack was carried out and the money laundering that followed bear several similarities to previous crypto thefts believed to have been committed by the Lazarus group.
See also: CISA: Hackers exploit PwnKit Linux vulnerability
Harmony said it is “working on various options” to compensate users as it investigates the theft, but stressed that “additional time is needed.” The company also offered a $1 million cash reward for the return of stolen crypto and information about the hack.
North Korea is often accused of conducting cyberattacks and exploiting crypto to circumvent Western sanctions. Earlier this year, the US Treasury Department attributed a $600 million heist on the Ronin Network, a so-called “sidechain” for the popular crypto game Axie Infinity, to Lazarus .
See also: Walmart: Denies being attacked by Yanluowang ransomware
North Korea has denied involvement in state- sponsored cyberattacks in the past, including a 2014 data breach targeting Sony Pictures.
Information source: cnbc.com
