North Korea’s Lazarus Hackers Try to Exfiltrate Harmony Funds

The notorious cybercrime group used Ethereum-based Railgun to anonymize their movements, but exchanges froze some assets


Source: Shutterstock / BeeBright, modified by Blockworks


North Korean hacker group Lazarus made attempts to move funds worth $63 million that were stolen from last year’s Harmony bridge hack, but the crypto exchanges used for the process claim its transfers have been blocked.

Blockchain sleuth ZachXBT shared on Twitter that the group moved some 41,000 ETH over the weekend using Ethereum-based Railgun, a smart contract that keeps user identities private, to exchanges Binance, OKX and Huobi. The transactions were carried out between Jan. 13 and 14.

ZachXBT also shared over 350 addresses associated with the hacker group. 

Binance CEO Changpeng Zhao tweeted that the exchange has previously detected the hacker’s fund movement, and that it coordinated with Huobi in freezing the accounts. They also together managed to recover 124 bitcoin ($2.6 million), according to Zhao, implying that some of the stolen ether was swapped for bitcoin.

Huobi too was able to detect and prevent the hacker from attempting to launder funds, according to Justin Sun. About Capital, Sun’s investment firm, acquired Huobi in October

Harmony’s Horizon bridge was one of the biggest hacks of last year. It allows users to move their cryptoassets via cross-chain transfers between Ethereum, Binance Smart Chain and Harmony blockchains. The bridge was exploited in June 2022 for $100 million, with the proceeds initially moved via now-OFAC-sanctioned Tornado Cash

Blockchain analytics firm Elliptic said that different types of cryptoassets were stolen including ETH, BNB, USDT, USDC and Dai. After the theft, the hacker used different types of decentralized exchanges to swap the tokens for ETH, which is a “common technique utilized by DeFi hackers,” the firm added. 

The total amount of funds lost to hacks in 2022 amounted to $4.3 billion of cryptocurrency, representing a 37% jump from 2021. Smart contract vulnerabilities that lead to malicious exploits remain among the most pressing threats that need to be solved in 2023.

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

MON - WED, MARCH 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience:  Attend expert-led panel discussions and fireside chats  Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts   Grow your network […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research



Akash is a general-purpose compute platform with GPUs, storage, LLM training or inference, and validator hosting through its two-sided marketplace.


The SEC could allow half a dozen or more such funds to launch at once, Ark Invest CEO says


2023 saw a decline in a16z crypto funding, but the behemoth VC firm teased what it’s excited for next year


“Iran Unchained” launched a new version of its grant platform to make donations to activists easier


The stablecoin marks the first time a regulated European bank has made a euro-pegged stablecoin available on a crypto exchange


Build it and they will come, perhaps, but making crypto easier to use is turning out to be just as important


Amid moves by Itau Unibanco and Nubank, the country could serve as “a proof of concept” for TradFi-crypto integrations, industry research exec says