Shalini Nagarajan

<div id="highlights-block_634d446fc15cd" class="highlights">
 <ul>
 <li>Lazarus is most likely targeting Japanese crypto operators through cyberattacks, authorities say</li>
 <li>Crypto businesses urged to caution against phishing attacks and social engineering</li>
 </ul>
 
</div>



North Korean hacking group Lazarus plotting phishing and social engineering attacks against crypto businesses, authorities in Japan have warned.



Local police, Japan’s financial regulator and the National Center of Incident Readiness and Strategy warned local crypto businesses in a recent <a href="https://www.npa.go.jp/cyber/pdf/R041014_cyber_alert.pdf">advisory statement</a> about further hacking attempts. They also laid out preventive measures to monitor breaches.



Since Lazarus is state-sponsored, it is believed proceeds from the hacks may go toward North Korea’s nuclear weapons program. The group has also been associated with using crypto mixer Tornado Cash, recently <a href="https://cms.blockworks.co/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash/">sanctioned</a> by the US Treasury, to conceal the origin of stolen funds.



The authorities didn’t mention which crypto businesses were targeted by Lazarus, but warned that security measures such as improved private key management are warranted.



They asked both individuals and companies to implement countermeasures such as ensuring the origin of downloaded files is a trusted source, interfaces to web applications are legitimate and private keys are stored offline, such as on a hardware wallet.



Lazarus is believed to have stolen more than $1.75 billion worth of cryptoassets since its formation in 2009, <a href="https://blog.chainalysis.com/reports/lazarus-group-kucoin-exchange-hack/">Chainalysis</a> found last year. The group has been behind several crypto exchange hacks, including the theft of $49 million worth of crypto from Upbit in 2019.



After several companies had their internal systems hacked and crypto stolen, police reportedly launched an investigation within a special investigation unit. They eventually found Lazarus to be the culprit.



A <a href="https://docs.google.com/document/u/1/d/1pTtOJ9Jg4jPE8Xts8OAZ57QYSqlKwsj4QFePaXLbAsY/edit">local report</a> by Japan News states it isn’t usual to name a suspected attacker before a more substantial action like an arrest, but that publicly naming the group is also viewed as an effective move to preempt attacks, as it could prompt people to take action and remain vigilant.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Japan-based Crypto Businesses Warned of Possible Cyberattack Threat

<div id="highlights-block_634d2dcfbb9e2" class="highlights">
 <ul>
 <li>Hack amounted to 4% of TempleDAO’s assets</li>
 <li>Tornado Cash is a sanctioned entity in the US, meaning individuals there are prohibited from dealing with the mixer</li>
 </ul>
 
</div>



A hacker who exploited DeFi protocol TempleDAO used sanctioned crypto mixer Tornado Cash to move their stolen funds.



Earlier this month, the yield-farming protocol was <a href="https://cms.blockworks.co/templedao-loses-2-million-in-latest-exploit/" target="_blank" rel="noreferrer noopener">exploited</a> for 1,831 ETH (around $2.34 million). All funds were moved to a <a href="https://etherscan.io/address/0x2b63d4a3b2db8acbb2671ea7b16993077f1db5a0" target="_blank" rel="noreferrer noopener">new wallet</a>. 



<a href="https://etherscan.io/address/0x2b63d4a3b2db8acbb2671ea7b16993077f1db5a0" target="_blank" rel="noreferrer noopener">Etherscan data</a> shows about the same amount of ether was transferred from the hacker’s identified address to a Tornado Cash router on Sunday. The move will obfuscate the destination of the stolen funds. The protocol’s immutable smart contracts are capable of providing privacy for criminals as well as lawful users.



Blockchain investigator PeckShield first <a href="https://twitter.com/peckshield/status/1581627065924694021?t=BH6lEyp9hP8xwiPz2cUe_Q&amp;s=19" target="_blank" rel="noreferrer noopener">noted</a> the exploiter’s use of the crypto mixer.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The <a href="https://twitter.com/templedao?ref_src=twsrc%5Etfw">@templedao</a> exploiter is starting to move funds via <a href="https://twitter.com/TornadoCash?ref_src=twsrc%5Etfw">@TornadoCash</a> <a href="https://t.co/UOl3RJjExq">https://t.co/UOl3RJjExq</a> <a href="https://t.co/SReMSq573P">pic.twitter.com/SReMSq573P</a>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1581627065924694021?ref_src=twsrc%5Etfw">October 16, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The transfers began with 0.1 ether, followed within minutes by multiple other transactions worth 100 ether each.



Tornado Cash acts as a cryptoasset mixer, making it extremely difficult to trace precisely the origin of funds withdrawn. It was added to the US Treasury’s <a href="https://cms.blockworks.co/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash/" target="_blank" rel="noreferrer noopener">sanctioned list</a> of “Specially Designated Individuals” in August, prohibiting people in the country from dealing with the service. 



The Treasury’s primary <a href="https://home.treasury.gov/news/press-releases/jy0916" target="_blank" rel="noreferrer noopener">concern</a> was the mixer’s role in laundering over $455 million worth of cryptoassets stolen by the North Korean hacking group Lazarus. 



Before TempleDAO’s exploit, the protocol’s total value locked stood at about $57 million, according to DeFiLlama. The attack amounted to about 4% of its assets. Security firm BlockSec said the <a href="https://twitter.com/BlockSecTeam/status/1579843881893769222" target="_blank" rel="noreferrer noopener">root cause</a> behind it was insufficient access control to a specific function in the affiliated Stax Finance smart contract. 



<h3 class="wp-block-heading">October marks the highest value of crypto hacked all year</h3>



October has so far turned out to be a <a href="https://cms.blockworks.co/october-already-record-month-for-hacks-and-exploits/" target="_blank" rel="noreferrer noopener">record month</a> for hacking activity, with stolen funds amounting to $718 million across 11 different DeFi protocols, according to Chainalysis.



The $100 million exploit of <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">Binance’s BNB chain</a> and the $112 million <a href="https://cms.blockworks.co/mango-markets-exploit-plot-revealed/" target="_blank" rel="noreferrer noopener">extracted from Mango Markets</a> took place in the last two weeks  — and the month is only half over.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

TempleDAO Hacked Funds Deposited to Tornado Cash

Casey Wagner

<div id="highlights-block_63039fe91dcf8" class="highlights">
 <ul>
 <li>Ronin bridge hackers moved funds to the Bitcoin network, new report shows </li>
 <li>Lazarus Group has used various crypto mixing services to conceal funds, including one not yet targeted by OFAC</li>
 </ul>
 
</div>



The hacking collective believed to be behind the $625-million Ronin bridge <a href="https://cms.blockworks.co/us-treasury-sanctions-first-crypto-mixing-service-following-record-hack/" target="_blank" rel="noreferrer noopener">hack</a> has transferred stolen ether into bitcoin using a cryptocurrency mixing service the US Treasury has not yet targeted, according to a new report.&nbsp;



<a href="https://cms.blockworks.co/alleged-crypto-ransomware-money-launderer-extradited-to-us/" target="_blank" rel="noreferrer noopener">Lazarus Group</a>, initially sanctioned by the Office of Foreign Assets Control (OFAC) in 2019, has used OFAC sanctioned cryptocurrency mixing services Blender.io and Tornado Cash to attempt to move and conceal funds.&nbsp;



Hackers have more recently tapped ChipMixer, a mixer founded in 2017 that has yet to be added to OFAC’s blocked list, according to the <a href="https://www.slowmist.com/report/first-half-of-the-2022-report(EN).pdf" target="_blank" rel="noreferrer noopener">report</a>&nbsp; from blockchain security firm SlowMist.&nbsp;



Learn: <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">How Crypto Mixers and Privacy Coins Work</a>



Lazarus Group converted 25.5 million USDC to ETH in March 2022. In the days that followed, hackers moved the ETH to various exchanges, including FTX and Crypto.com before withdrawing to the bitcoin network and mixing it through Blender.io, which the <a href="https://home.treasury.gov/news/press-releases/jy0768" target="_blank" rel="noreferrer noopener">Treasury sanctioned</a> in May.&nbsp;



Between April and May, the group moved funds through <a href="https://cms.blockworks.co/decentralized-or-not-officials-say-tornado-cash-responsible-for-illicit-activity/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>, which was added to OFAC’s blocked list earlier this month.&nbsp;



Many of the funds were mixed through various services, the report said. Roughly half of the laundered bitcoins have been run through ChipMixer, according to SlowMist.&nbsp;



“36.6% of laundered funds are currently held at the hacker&#8217;s address, totalling 2,586 BTC,” the report noted. “6.2% of funds laundered were moved to Blender, with 3.8% of laundered funds moved to CryptoMixer and a small percentage to other unknown entities.”&nbsp;



The report comes as 2022 has seen an uptick in the use of <a href="https://cms.blockworks.co/illicit-crypto-moving-to-mixers-on-pace-to-double-in-2022/" target="_blank" rel="noreferrer noopener">crypto mixing services</a>, which allow users to <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">conceal the transaction history</a> of certain cryptocurrencies by pooling and mixing them together with other users’ funds.&nbsp;



The 30-day moving average of value received by mixers reached an all-time high of nearly $52 million worth of crypto on April 19, according to <a href="https://blog.chainalysis.com/reports/cryptocurrency-mixers/" target="_blank" rel="noreferrer noopener">a July report by Chainalysis</a> — or roughly double the volumes at the same time in 2021.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Report: Ronin Crypto Hackers Find New Mixer to Convert Stolen ETH to BTC

Sebastian Sinclair

<div id="highlights-block_62fdea0f69dbf" class="highlights">
 <ul>
 <li>Denis Dubnikov is alleged to have laundered more than $400,000 as part of a ransomware scheme involving crypto</li>
 <li>The Ryuk ransomware threat attempts to lock up systems in a bid to extract bitcoin payment</li>
 </ul>
 
</div>



A 29-year-old Russian citizen has been extradited from the Netherlands to the US to face money laundering charges involving tens of millions of dollars in crypto-ransomware proceeds.



The US Department of Justice accuses Denis Dubnikov of laundering more than $400,000 in funds lifted from Ryuk ransomware attacks as part of a $70 million scheme, according to a statement by the <a href="https://www.justice.gov/opa/pr/alleged-russian-money-launderer-extradited-netherlands-us" target="_blank" rel="noreferrer noopener">Department of Justice</a> on Wednesday.



Dubnikov and others involved in the scheme are alleged to have laundered funds from the attacks through various national and international transactions in a bid to conceal the funds’ provenance.



First appearing in 2018, Ryuk is designed to infiltrate private networks and gain administrative access to multiple systems. Once inside, Ryuk encrypts local files to lock up multiple computers before soliciting payment in crypto — usually bitcoin — to restore services.



Ryuk along with several other high-profile ransomware threats have been used to extract payment from government institutions, healthcare providers, hospitals and other businesses.&nbsp;



In May of last year, Colonial Pipeline was forced to halt its services and pay more than $4 million in bitcoin following an attack that subsequently ignited fuel shortage fears across the US.



Weeks later, the world’s largest meat producer by total sales, JBS Holding, shelled out $11 million in bitcoin in an attempt to circumvent ransomware impacting its business and supply chains.



Efforts from North Korea’s Lazarus Group, Eastern Europe’s Darkside and others have been linked to various hacks across the industry, including a <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">$625 million hack</a> of the on Axie Infinity-tied Ronin Network bridge earlier this year.



Cryptocurrencies have repeatedly been blamed by law enforcement officials for facilitating anonymous transactions and assisting hackers in their attempts. However, the ability to <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">transparently track transactions</a> on-chain, has also helped law enforcement <a href="https://cms.blockworks.co/couple-arrested-as-government-recovers-3-6b-in-stolen-bitcoin/" target="_blank" rel="noreferrer noopener">trace and reclaim</a> stolen funds. 



Lazarus and others are said to have used crypto mixing service <a href="https://cms.blockworks.co/tag/tornado-cash/" target="_blank" rel="noreferrer noopener">Tornado Cash</a> in a bid to launder proceeds and conceal provenance. The <a href="https://cms.blockworks.co/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash/" target="_blank" rel="noreferrer noopener">Office of Foreign Asset Control</a> banned its use for US citizens as well as 45 Ethereum addresses on Aug. 8.



Roughly three-fourths of funds passing through the privacy tool, however, are unconnected with criminal activity or sanctions evasion, and only 10.5% are stolen funds, <a href="https://blog.chainalysis.com/reports/tornado-cash-ofac-designation-sanctions/" target="_blank" rel="noreferrer noopener">according to</a> on-chain analytics firm Chainalysis.



A five-day jury trial is expected to commence on Oct. 4 where Dubnikov faces a maximum sentence of 20 years in prison for his alleged involvement.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Alleged Crypto Ransomware Money Launderer Extradited to US

<div id="highlights-block_625dcee381ae5" class="highlights">
 <ul>
 <li>The Lazarus Group and APT38 have been named as those responsible for the theft</li>
 <li>Exploiters used hacked private keys to forge withdrawals on March 23, Ronin said</li>
 </ul>
 
</div>



The US Federal Bureau of Investigation has placed &#8220;cyber actors&#8221; from North Korea at the heart of last month&#8217;s $625 million hack on the Ethereum-linked sidechain Ronin Network.



Through an investigation, the agency said it was able to &#8220;confirm&#8221; hacker collectives Lazarus Group and APT38 are responsible for the theft of hundreds of millions of dollars in crypto, a Thursday <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea" target="_blank" rel="noreferrer noopener">statement</a> reads.



Exploiters, according to Ronin, used <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">hacked private keys</a> to forge withdrawals on March 23. The breach wasn’t discovered until several days later, when a user was unable to withdraw 5,000 ETH.



State-sponsored Lazarus has been accused of multiple digital asset-based hacks, including a year-long endeavor beginning in 2017 in which the group reportedly managed to siphon off <a href="https://thenextweb.com/news/cryptocurrency-attack-report" target="_blank" rel="noreferrer noopener">$571 million</a>.



The Treasury Department last week <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">sanctioned the hacking collective</a> and the Ethereum address allegedly behind the theft.



As part of its efforts to combat blockchain-related crime, the FBI established a new unit last month led by Eun Young Choi, a former senior counsel to the deputy attorney general.



The group, along with APT38, operates at the behest of the Democratic People&#8217;s Republic of Korea (DPRK) under dictator Kim Jong Un. The isolated northern nation on the Korean Peninsula is strangled by economic sanctions and threatened by military encirclement from Western allies over its continued use of nuclear arms.



Cryptocurrency is viewed by some experts as a means to circumvent capital controls and economic sanctions, as well as to hide the wealth of North Korea&#8217;s political elite. It has also been speculated it is one of several mechanisms that fund Kim&#8217;s heavily sanctioned regime.



&#8220;The FBI&#8230;will continue to expose and combat the DPRK’s use of illicit activities – including cybercrime and cryptocurrency theft,&#8221; the statement said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.