Shalini Nagarajan

North Korean hacker group Lazarus made attempts to move funds worth $63 million that were stolen from last year’s <a href="https://blockworks.co/news/defi-cross-chain-horizon-bridge-hacked-for-100m">Harmony bridge hack</a>, but the crypto exchanges used for the process claim its transfers have been blocked.



Blockchain sleuth ZachXBT <a href="https://twitter.com/zachxbt/status/1614771861266792449" target="_blank" rel="noreferrer noopener">shared</a> on Twitter that the group moved some 41,000 ETH over the weekend using Ethereum-based Railgun, a smart contract that keeps user identities private, to exchanges Binance, OKX and Huobi. The transactions were carried out between Jan. 13 and 14.



ZachXBT also shared over 350 addresses associated with the hacker group.&nbsp;



Binance CEO Changpeng Zhao <a href="https://twitter.com/cz_binance/status/1614887319177428992" target="_blank" rel="noreferrer noopener">tweeted</a> that the exchange has previously detected the hacker’s fund movement, and that it coordinated with Huobi in freezing the accounts. They also together managed to recover 124 bitcoin ($2.6 million), according to Zhao, implying that some of the stolen ether was swapped for bitcoin.



Huobi too was able to detect and prevent the hacker from attempting to launder funds, <a href="https://twitter.com/justinsuntron/status/1614901672102465538" target="_blank" rel="noreferrer noopener">according to</a> Justin Sun. About Capital, Sun’s investment firm, <a href="https://blockworks.co/news/huobi-founder-sells-100-stake-to-justin-sun-fund-report">acquired Huobi in October</a>.&nbsp;



Harmony’s Horizon bridge was one of the biggest hacks of last year. It allows users to move their cryptoassets via cross-chain transfers between Ethereum, Binance Smart Chain and Harmony blockchains. The bridge was exploited in June 2022 for $100 million, with <a href="https://blockworks.co/news/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service">the proceeds initially moved</a> via now-OFAC-sanctioned <a href="https://blockworks.co/tag/tornado-cash">Tornado Cash</a>.&nbsp;



Blockchain analytics firm Elliptic <a href="https://hub.elliptic.co/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack/" target="_blank" rel="noreferrer noopener">said</a> that different types of cryptoassets were stolen including ETH, BNB, USDT, USDC and Dai. After the theft, the hacker used different types of decentralized exchanges to swap the tokens for ETH, which is a “common technique utilized by DeFi hackers,” the firm added.&nbsp;



The<a href="https://blockworks.co/news/crypto-hacks-2022"> total amount of funds lost to hacks in 2022</a> amounted to $4.3 billion of cryptocurrency, representing a 37% jump from 2021. Smart contract vulnerabilities that lead to malicious exploits remain among the most pressing threats that need to be solved in 2023.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

North Korea’s Lazarus Hackers Try to Exfiltrate Harmony Funds

David Canellis

Members of a notorious hacker crew with links to North Korea have been posing as venture capitalists in a bid to phish — and steal from — crypto startups.



A subunit of North Korean cyberwarfare agency Bureau 121, called BlueNoroff, has now deployed more than 70 domains during its phishing campaign overall, with a recent focus on Japan’s financial sector.



“[BlueNoroff] created numerous fake domains that look like venture capital and bank domains. Most of the domains imitate Japanese venture capital companies, indicating that the group has an extensive interest in Japanese financial entities,” cybersecurity firm Kaspersky <a href="https://securelist.com/bluenoroff-methods-bypass-motw/108383/" target="_blank" rel="noreferrer noopener">said</a>.



The hackers have imitated venture capital firms such as Beyond Next Ventures and Angel Bridge, as well as banking giants Bank of America and Mizuho Financial Group.&nbsp;



BlueNoroff has also adopted new malware strains that rely on different file types to bypass Windows system flags, employing .iso and .vhd extensions instead of Word documents.&nbsp;



The malware, usually delivered via email, is hidden inside those files, which release a malicious PDF or PowerPoint presentation once opened. Additional malware is then downloaded directly to the target machine, installing backdoors and executing commands to steal sensitive data and high system privileges.



The US Army in 2020 <a href="https://irp.fas.org/doddir/army/atp7-100-2.pdf" target="_blank" rel="noreferrer noopener">estimated</a> that BlueNoroff is made up of roughly 1,700 individuals operating around the world. Authorities say it aims to pull off &#8220;financial cybercrime by concentrating on long-term assessment and exploiting enemy network vulnerabilities.”&nbsp;



“This group exploits the systems for financial gain for the regime or to take control of the system.”



Kaspersky&#8217;s researchers have tracked BlueNoroff’s crypto efforts since 2018 — two years after the group attempted to steal $1 billion from the central bank of Bangladesh, though making off with just $63 million.



In January, Kaspersky <a href="https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" target="_blank" rel="noreferrer noopener">detailed</a> instances of the hackers pretending to be Barry Silbert’s crypto hedge fund Digital Currency Group in phishing attempts, among numerous other digital asset firms including Emurgo, a Cardano-focused software firm, and Ant Capital.


<div class="wp-block-image">
<figure class="aligncenter"><img decoding="async" src="https://lh3.googleusercontent.com/jDezfOOaH-yISqFg_0tNRTZTeRix3-s3bcd_WY54ZjGTeMs3BMBh0anopyxYuHGmRTLjVPIUkYjmubXYIpZAvs6pIdEVFJNKQ2OxiehXN53mfAn8MUpvpGyrndcmiDD2JCXOLSkVjm3D67N8omHcTM-rXinDNAhkUXCVSi0-2Y44tDWsxPLJJni1NgkPYw" alt=""/><figcaption class="wp-element-caption">Fake BlueNoroff phishing document cites purported investments in crypto exchange bitFlyer</figcaption></figure></div>


Fellow Bureau 121 subunit <a href="https://blockworks.co/tag/lazarus" target="_blank" rel="noreferrer noopener">Lazarus Group</a> is believed to be responsible for <a href="https://blockworks.co/news/crypto-hacks-2022" target="_blank" rel="noreferrer noopener">major hacks on crypto startups</a>, including the $500 million Axie Infinite and $100 million Harmony incidents this year.



BlueNoroff itself has been responsible for crypto thefts worth millions of dollars from crypto startups, Kaspersky has said.



The reports <a href="https://blockworks.co/news/japan-based-crypto-businesses-warned-of-possible-cyberattack-threat" target="_blank" rel="noreferrer noopener">align with others from October</a>, in which Japanese authorities disclosed a spate of Lazarus-linked phishing and social engineering attacks on local crypto funds, some of which amounted to lost capital.



“As we can see from our latest finding, this notorious actor has introduced slight modifications to deliver their malware. This also suggests that attacks by this group are unlikely to decrease in the near future,” researchers said.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Crypto Startups Beware: That VC Email Might Be North Korean Hackers

Nefarious actors have been increasingly turning to Telegram, according to Microsoft — as well as one of the tech gian’s own products — in attempts to infiltrate crypto companies.



The tech giant categorized the pervasiveness of such hacks, typically driven by malware, as a barrier to widespread adoption of cryptocurrencies. More concerning, still, in Microsoft’s estimation: Hackers are becoming quite adept at their brands of trickery.



“We are also seeing more complex attacks wherein the threat actor shows great knowledge and preparation, taking steps to gain their target’s trust before deploying payloads,” Microsoft wrote in a <a href="https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/" target="_blank" rel="noreferrer noopener">blog </a>Tuesday.



Microsoft detailed its own investigation of a would-be bad actor, “DEV-0139,” which the company said infiltrated Telegram chats between an unidentified crypto exchanges and their “VIP” clients, as well as the company’s other counterparties. The company said the hacker, or hacking collective, employed Excel files in bids to acquire valuable and private information.&nbsp;



While pretending to represent a separate crypto company — with apparently passable knowledge of the operations and communications of both firms — Microsoft said they invited the target to a different chat, where DEV-0139 attempted solicited feedback on the fee structure used by the crypto exchanges.



Upon gaining the trust of the target, the malicious actor sent an Excel file called “OKX Binance &amp; Huobi VIP fee comparison.xls” in an alleged bid to project credibility.



Opening the Excel file itself triggered a series of mishaps. A set of automatic actions contained in the file were used to obtain the user’s data, executed in invisible mode. This malicious “backdoor” allowed the bad actor to remotely access the infected system.&nbsp;



Microsoft also found another older file using the same technique, suggesting the incident wasn’t isolated — and that the actor may be executing similar campaigns with other targets.&nbsp;



It isn’t unusual for crypto scammers to use bots on Telegram to hoodwink users and lead them to malicious links. A 2021 report by digital threat detection firm <a href="https://q6cyber.com/blog/otp_bots_are_a_growing_threat/" target="_blank" rel="noreferrer noopener">Q6 Cyber</a> found that bot services, which can be purchased for around $300, can also be used to target investors.



2022 has already gone down as a year full of <a href="https://blockworks.co/news/the-nine-largest-crypto-hacks-in-2022" target="_blank" rel="noreferrer noopener">high-profile thefts</a> in the sector, including $600 million from FTX, $182 million from Beanstalk and $325 million from Wormhole. Interest in self-custody of assets has accordingly increased dramatically — boosted even more by user concerns of keeping crypto assets on centralized exchanges in light of FTX’s <a href="https://blockworks.co/news/1-binance-ftx-deal-is-off-unless-ftx-us-is-part-of-the-package-source" target="_blank" rel="noreferrer noopener">implosion</a>.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Microsoft IDs Excel, Telegram Threat Targeting Crypto Startups

<div id="highlights-block_631600497a278" class="highlights">
 <ul>
 <li>KyberSwap has offered a 15% bounty to its hackers if the stolen funds are returned</li>
 <li>Binance previously helped recover funds stolen from Curve Finance and Axie Infinity</li>
 </ul>
 
</div>



Binance may have helped crack last week’s $265,000 hack on decentralized exchange (DEX) platform KyberSwap.



Binance CEO Changpeng Zhao <a href="https://twitter.com/cz_binance/status/1565976776710430721" target="_blank" rel="noreferrer noopener">said</a> on Saturday that his exchange’s security team identified two suspects behind the attack, and that their identities have been forwarded to the KyberSwap team.&nbsp;



On Sept. 1, KyberSwap issued an <a href="https://blog.kyber.network/notice-of-exploit-of-kyberswap-frontend-963aa8febd6a" target="_blank" rel="noreferrer noopener">alert</a> to notify users that a hacker exploited a frontend vulnerability which led to the draining of two whale wallets on Ethereum and Polygon.&nbsp;



The team discovered malicious code in its Google Tag Manager (GTM) which led to fraudulent transaction approvals, which allowed a hacker to transfer user funds to their account. The GTM was then disabled, according to a blog.



“The script had been discreetly injected and specifically targeting whale wallets with large amounts,” KyberSwap said.



The DeFi platform, which doubles as both a DEX and a liquidity protocol, offered a 15% bounty (around $40,000) to the hacker if they returned the funds and spoke with the team. Compromised addresses would be fully compensated, the network said.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><a href="https://twitter.com/hashtag/Binance?src=hash&amp;ref_src=twsrc%5Etfw">#Binance</a> security team has identified two suspects for yesterday&#39;s KyberSwap hack. We have provided the intel to the Kyber team, and are coordinating with LE (law enforcement). Stay <a href="https://twitter.com/hashtag/SAFU?src=hash&amp;ref_src=twsrc%5Etfw">#SAFU</a>. <a href="https://t.co/tbQBGaGTNG">https://t.co/tbQBGaGTNG</a>&mdash; CZ 🔶 Binance (@cz_binance) <a href="https://twitter.com/cz_binance/status/1565976776710430721?ref_src=twsrc%5Etfw">September 3, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Around the same time as the KyberSwap incident, privacy-focused startup ShadowFi also <a href="https://medium.com/@ShadowFi/shadowfi-the-exploit-44733d1f8cb0" target="_blank" rel="noreferrer noopener">suffered</a> a cyberattack leading to around $301,000 in losses. PeckShield <a href="https://twitter.com/ShadowFi_/status/1565919551186935808" target="_blank" rel="noreferrer noopener">identified</a> the hacker as NeorderDAO, a little-known crypto collective whose website is now offline.



Binance has often shown commitment to helping out crypto projects. Last month, the exchange managed to <a href="https://cms.blockworks.co/binance-recovers-majority-funds-stolen-in-curve-finance-hack/" target="_blank" rel="noreferrer noopener">recover</a> a majority of the funds hackers stole from DeFi protocol Curve Finance. It also <a href="https://twitter.com/cz_binance/status/1517385438469791749" target="_blank" rel="noreferrer noopener">helped</a> Axie Infinity recover nearly $6 million allegedly stolen by North Korean hacking unit Lazarus Group in April.&nbsp;



DeFi hacks have been exploding in the past two years, hitting over <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/" target="_blank" rel="noreferrer noopener">$1.2 billion</a> in the first quarter of this year alone, according to Immunefi. The Federal Bureau of Investigation recently <a href="https://cms.blockworks.co/fbi-issues-warning-over-defi-exploits-open-source-development/" target="_blank" rel="noreferrer noopener">warned</a> against such exploits, saying cyber criminals are on the lookout to abuse the complexity of cross-chain functionality.&nbsp;



Kyber’s KNC token has fallen 5% since the hack to $1.65, data from <a href="https://www.tradingview.com/chart/?symbol=FTX%3AKNCUSD" target="_blank" rel="noreferrer noopener">TradingView</a> shows.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Binance Identifies Suspects Who Stole From KyberSwap Whales

Ben Strack

<div id="highlights-block_6244bc1609abe" class="highlights">
 <ul>
 <li>Blockchain transparency makes it hard to pull off large-scale cryptocurrency theft, according to blockchain data firm Chainalysis</li>
 <li>Axie Infinity co-founder Aleksander Leonard Larson tweeted Wednesday that several new validators would be added to the Ronin network</li>
 </ul>
 
</div>



For the hacker who recently <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">exploited the Ronin Network</a> for roughly $625 million, cashing out the funds will likely be a challenge. 



The Ethereum-linked sidechain used for blockchain game Axie Infinity was attacked last week, when the person or group responsible made off with 173,600 ether and 25.5 million USDC.



The exploiter used hacked private keys to forge withdrawals on March 23, according to <a href="https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w" target="_blank" rel="noreferrer noopener">a Tuesday statement</a>. The breach was discovered nearly a week later when a user was unable to withdraw 5,000 ETH.



The hackers have tried to sell about 6,500 stolen ETH, transferring the tokens to three different exchanges, according to William Quigley, co-founder of stablecoin Tether and non-fungible token (NFT) blockchain platform WAX. All of the stolen USDC has been transferred out to various wallets and DeFi protocols, Etherscan data shows.



Most of the funds remain in the <a href="https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96" target="_blank" rel="noreferrer noopener">hacker’s wallet</a>, according to the network. Aleksander Leonard Larson, co-founder and chief operating officer of Axie Infinity, tweeted Wednesday that Axie is committed to ensuring all of the drained funds are recovered or reimbursed.



“Been an intense 36 hours,” <a href="https://twitter.com/Psycheout86/status/1509134627319033863" target="_blank" rel="noreferrer noopener">Larson tweeted</a>. “Our internal network is currently going through a deep forensics review to ensure there is no lingering threat.”



Selling the remaining 176,000 or so ETH will be difficult, Quigley told Blockworks, adding that the address has been blacklisted to exchanges.



“Sky Mavis has also retained Chainalysis to ensure that any of the stolen ETH moved from this Ethereum address will be tracked,” he said. “It doesn&#8217;t seem like the hacker will have much luck cashing out.”



Kim Grauer, Chainalysis’ director of research, said the <a href="https://cms.blockworks.co/hackers-steal-over-600m-biggest-in-defi-history/" target="_blank" rel="noreferrer noopener">Poly Network hack in August</a> and subsequent <a href="https://cms.blockworks.co/poly-network-hacker-returns-600-million-offered-500000-bug-bounty/" target="_blank" rel="noreferrer noopener">return of funds</a> illustrated the rising difficulty of pulling off a large-scale cryptocurrency theft.



While criminally obtained fiat currency can be moved through “shady bank accounts” — and authorities rely on subpoenas and the cooperation of financial institutions to trace its path — Grauer said anyone can view transactions executed on public blockchains.



“With the inherent transparency of blockchains and the eyes of an entire industry on them, it&#8217;s difficult for any cryptocurrency hacker to escape with a large cache of stolen funds,” Grauer said. “In most cases, the best they could hope for would be to evade capture as the funds sit frozen in a blacklisted private wallet.”



<h3>How did it happen and what’s next?</h3>



Illicit crypto transactions <a href="https://cms.blockworks.co/chainalysis-report-illicit-addresses-received-14b-in-2021/" target="_blank" rel="noreferrer noopener">reached $14 billion</a> last year, according to a February Chainalysis report. Though that marks an all-time high, illicit activity in terms of total crypto transaction volume has never been lower, as the market capitalization of digital assets grew in 2021.



The latest hack was an outlier, Quigley said, in that it occurred in part because a single entity, Sky Mavis, controlled four of the Ronin’s chain’s nine validator nodes. The hacker gained control of a fifth node — good for a majority — run by Axie DAO.



Larson called the hack “a social engineering attack combined with a human error” in a Wednesday tweet, adding that Ronin plans to add additional validators to boost decentralization.&nbsp;



The fact that several days passed before the public became aware is rare and “surprising,” Quigley said.



“Most people did not appear to know that Axie Infinity ran its own layer-2 blockchain on top of Ethereum,” he said. “People playing Axie Infinity or providing liquidity to Ronin&#8217;s decentralized exchange, Katana, might have been more circumspect about depositing hundreds of millions of dollars on the Ronin Bridge if they knew Axie Infinity managed the passwords to five of the nine Ronin validator nodes.”



Layer-2 chains are inherently more vulnerable because the attack vectors double when you operate atop another chain, Quigley said. Exploits can be operational — when the parties running a system don’t have robust security practices — or code-related.



“Large complex systems, like fully featured layer-2 based blockchain games with hooks into other third-party platforms, is a vastly more challenging system to audit,” he said, noting the operational nature of the Ronin hack.



As more value flows through cross-chain bridges, they’re becoming increasingly attractive targets for hackers, according to Grauer. Though the Ronin case involved hacked private keys, many DeFi (decentralized finance) hacks are attributed to code vulnerabilities.&nbsp;



“While not foolproof, a valuable first step towards addressing issues like this could be for extremely rigorous code audits to become the gold standard, both for those building protocols and for the investors evaluating them,” Grauer said. “Over time, the strongest, safest smart contracts can serve as templates for developers to build from.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">