Casey Wagner

US Treasury Deputy Secretary Wally Adeyemo has a message for digital asset firms: Get in line, or end up like Binance.&nbsp;



“I hoped the digital asset industry would take up this call to partner with government, design new tools and pursue new ways to protect digital assets from being abused,” Adeyemo said at the Blockchain Association Policy Summit in Washington DC Wednesday.&nbsp;



While many digital asset firms have taken steps toward compliance, others have failed to act. According to Adeyemo, this “represents a clear and present danger for national security.”&nbsp;



The Treasury Department sent a legislative proposal to <a href="https://blockworks.co/tag/congress">Congress</a> on Tuesday asking for additional authority to oversee the crypto space, including allowing it to step outside of the United States.&nbsp;



Read more: <a href="https://blockworks.co/news/biggest-court-cases-2023">From SBF to Binance: Biggest court cases of 2023</a>



Treasury officials have asked Congress to expand the International Emergency Powers Act to explicitly allow the agency to “designate blockchain nodes or other elements of cryptocurrency transactions,” according to a copy of the proposal obtained by Blockworks.&nbsp;



Some industry members argue that given the <a href="https://blockworks.co/tag/treasury">Treasury</a>’s apparent success thus far in sanctioning exchanges, mixing services and other actors, granting the agency greater authority is unnecessary.&nbsp;



The rules cannot always keep up with the technology, Adeyemo said in response to the criticism.&nbsp;



“The thing that I learned most from being at Treasury during the financial crisis is that innovation outpaced regulation,” he added. “Our goal is to make sure that we have the flexibility.” 



Read more: <a href="https://blockworks.co/news/treasury-crypto-terrorist-financing">Treasury urges crypto companies to ‘prevent’ terrorist financing</a>



Adeyemo’s remarks came hours after his office announced <a href="https://blockworks.co/news/sinbad-sanctioned-ofac-treasury">sanctions against cryptocurrency mixing service Sinbad</a> for allegedly facilitating North Korea state-sponsored hacking group Lazarus’ money laundering.&nbsp;



For illicit actors, the digital asset ecosystem is the “prefered” method of moving assets, as opposed to the traditional financial system, Adeyemo said.&nbsp;



“My message is simple: We will find you and hold you accountable,” he said to the digital asset industry and those enabling or facilitating illicit actions.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Binance

Treasury’s Wally Adeyemo: My agency needs more power to regulate crypto 

The US Department of the Treasury has sanctioned a cryptocurrency mixing service the government claims is a key money-laundering tool for the Lazarus Group.&nbsp;



“Sinbad has processed millions of dollars’ worth of virtual currency from Lazarus Group heists, including the Horizon Bridge and Axie Infinity heists,” the Office of Foreign Asset Control (OFAC), the Treasury’s department that oversees sanctions, said in a statement Wednesday.&nbsp;



Sinbad.io, a cryptocurrency mixing service created by an anonymous founder, became a favorite for North Korean-state sponsored hacking organization Lazarus in 2022, researchers from analytics firm Chainalysis said in its last <a href="https://www.chainalysis.com/blog/2022-biggest-year-ever-for-crypto-hacking/">annual report</a>. Researchers from <a href="https://www.elliptic.co/blog/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack/hss_channeltw-1344645140">Elliptic</a> agreed, saying in February they believed Sinbad is simply a relaunched version of Blender, the mixer OFAC blacklisted in 2022.&nbsp;



As of Wednesday, the US government had seized Sinbad’s website.&nbsp;



“Mixing services that enable criminal actors, such as the Lazarus Group, to launder stolen assets will face serious consequences,” Deputy Secretary of the Treasury Wally Adeyemo said in a statement Wednesday. “The Treasury Department and its US government partners stand ready to deploy all tools at their disposal to prevent virtual currency mixers, like Sinbad, from facilitating illicit activities.



Read more: <a href="https://blockworks.co/news/stake-hack-lazarus-group-north-korea-fbi">FBI blames North Korea’s Lazarus Group for $40M Stake hack</a>



Lazarus Group was added to <a href="https://blockworks.co/tag/ofac">OFAC’s</a> sanction list in September 2019.&nbsp;



Sinbad was used to launder a significant portion of the $100 million worth of crypto Lazarus stole in June 2023 from customers of Atomic Wallet, OFAC said. Lazarus also used the mixer “to launder a significant portion” of crypto stolen in the $620 million Axie Infinity heist, the office alleges.&nbsp;



“Sinbad is also used by cybercriminals to obfuscate transactions linked to malign activities such as sanctions evasion, drug trafficking, the purchase of child sexual abuse materials, and additional illicit sales on darknet marketplaces,” OFAC added.&nbsp;



The announcement comes as cryptocurrency advocacy groups <a href="https://blockworks.co/news/tornado-cash-fans-appeal">continue to fight OFAC in the courts</a> over the agency’s sanctions against Tornado Cash — a mixing service <a href="https://home.treasury.gov/news/press-releases/jy0916">sanctioned</a> in August 2022 for its alleged role in helping Lazarus launder more than $455 million in stolen funds.&nbsp;



Plaintiffs in two cases are bringing their battle against the Treasury to federal appellate courts. Joseph Van Loon, along with five other self-identified “Ethereum blockchain users” sued the US Treasury Department, Secretary Janet Yellen, the Office of Foreign Asset Control (OFAC) and OFAC Director Andrea Gacki in September 2022. A federal judge in Texas <a href="https://blockworks.co/news/judge-backs-us-treasury-tornado-cash-sanction">sided with the federal government</a> in August, rejecting the argument that OFAC was acting outside its jurisdiction.&nbsp;



Coin Center, Bankless co-founder David Hoffman and others <a href="https://blockworks.co/news/coin-center-sues-over-treasurys-tornado-cash-sanctions">filed a lawsuit against the same federal parties</a> in October 2022. Like in Loon’s case, a federal judge in Florida sided with the US government last month, prompting Coin Center and its co-plaintiffs to file an appeal in the Eleventh Circuit earlier this month.



Updated Nov. 29, 2023 at 11:06 am ET: Modified headline.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

lazarus group

Treasury sanctions crypto mixer Sinbad after money laundering accusations

Sebastian Sinclair

The FBI has issued a warning to crypto companies over recent blockchain activities tied to the theft of hundreds of millions of dollars by the Democratic People&#8217;s Republic of Korea (DPRK).



TraderTraitor-affiliated actors, also known as the <a href="https://blockworks.co/tag/lazarus-group">Lazarus Group</a> and APT38, are accused by the state of siphoning off funds from several crypto protocols and projects last year.



Over the last 24 hours, the FBI said it has tracked about 1,580 bitcoin (<a href="https://blockworks.co/price/btc">BTC</a>), worth more than $40 million, stolen by the DPRK and held in six Bitcoin addresses. The Bureau believes the DPRK may attempt to liquidate the digital assets held therein, according to a <a href="https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk">statement</a>.



Private sector entities are urged to examine the recent blockchain data linked to the addresses provided by the FBI on Tuesday and be vigilant against transactions directly with or derived from them.



“The FBI will continue to expose and combat the DPRK’s use of illicit activities — including cybercrime and virtual currency theft — to generate revenue for the regime,” it said in a statement.



Among the high-profile international crypto heists attributed to DPRK includes the theft of $60 million from payment providers Alphapo on June 22 and $37 million from CoinsPaid on the same day. A further $100 million from Atomic Wallet at the start of that month has also been flagged.



The thefts from Lazarus last year prompted warnings from several nations, including <a href="https://blockworks.co/news/japan-based-crypto-businesses-warned-of-possible-cyberattack-threat">Japanese local authorities</a>, to provide preventive measures against further attacks. On Monday, cybersecurity firm Palo Alto Networks’ CEO Nikesh Arora told <a href="https://www.cnbc.com/2023/08/21/palo-alto-networks-ceo-stresses-modern-integrated-cybersecurity.html#:~:text=with%20Jim%20Cramer-,Palo%20Alto%20Networks%20CEO%20Nikesh%20Arora%20told%20CNBC%27s%20Jim%20Cramer,gaining%20access%20to%20sensitive%20information.">CNBC</a> in an interview, that companies needed to beef up and modernize their systems in a bid to shield themselves from “bad actors.”



The FBI previously confirmed attacks against Harmony’s Horizon bridge and Sky Mavis’ <a href="https://blockworks.co/news/fbi-says-north-korea-behind-625m-ronin-hack">$625 million</a> hack on Ethereum-linked sidechain Ronin Bridge last year, alongside a Cybersecurity Advisory on TraderTraitor.&nbsp;



Lazarus made attempts to move funds worth <a href="https://blockworks.co/news/north-koreas-lazarus-hackers-try-to-exfiltrate-harmony-funds">$63 million</a> linked to the Horizon bridge, though concerted efforts from the industry, including exchanges, blocked the transfers.



In April, the US Treasury’s Office of Foreign Assets Control <a href="https://blockworks.co/news/treasury-sanctions-lazarus-group-members">sanctioned</a> three individuals, Wu Huihui, Cheng Hung Man and Sim Hyon Sop with alleged ties to the group.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

FBI flags imminent sale of $40M in stolen crypto funds linked to North Korea

Katherine Ross

The US Treasury’s Office of Foreign Assets Control announced sanctions against three individuals who have alleged ties to North Korea’s Lazarus Group on Monday.



Wu Huihui is based in the People’s Republic of China and allegedly “facilitated the conversion of virtual currency stolen by [Democratic People’s Republic of Korea] actors working with the Lazarus Group to fiat currency.”



Cheng Hung Man is based in Hong Kong and is believed to have <a href="https://home.treasury.gov/news/press-releases/jy1435#:~:text=The%20DPRK's%20Foreign%20Trade%20Bank,13382%2C%20is%20KKBC's%20parent%20company.">worked</a> with Wu to utilize “front companies to enable DPRK actors to bypass countering illicit finance requirements at financial institutions and access the U.S. financial system”



Sim Hyon Sop is based in Dandong, China and works for Korea Kwangson Banking Corp. (KKBC) — which was sanctioned for its ties to North Korea back in <a href="https://home.treasury.gov/news/press-releases/tg260">2009</a>. Sim “coordinated millions of dollars in financial transfers for the DPRK,” according to the allegations.



OFAC previously <a href="https://home.treasury.gov/news/press-releases/sm924">sanctioned</a> two Chinese nationals — Tian Yinyin and Li Jiadong — for allegedly laundering crypto linked to a 2018 hack of a cryptocurrency exchange. OFAC declined to name the exchange, however, though it noted that the Lazarus Group was believed to be tied to the attack.



Lazarus has been <a href="https://blockworks.co/news/fbi-says-north-korea-behind-625m-ronin-hack">tied to numerous hacks</a>, including the 2022 Ronin Network attack — which is widely believed to be the largest crypto heist to date. The hackers were able to steal $625 million in the attack, which the <a href="https://blockworks.co/news/fbi-says-north-korea-behind-625m-ronin-hack">FBI has since connected to Lazarus</a>.&nbsp;



Last year, the group is believed to have gone after several <a href="https://blockworks.co/news/japan-based-crypto-businesses-warned-of-possible-cyberattack-threat">Japanese crypto companies</a>, with data from OFAC suggesting that cyber actors linked to North Korea were able to steal $1.7 billion in crypto in 2022.



The Treasury Department believes that Lazarus Group is tied to the Reconnaissance General Bureau — the North Korean intelligence bureau — and “is involved in the trade of DPRK arms.” It is believed that the bureau uses its ill-gotten crypto to fund both nuclear and ballistic military programs in North Korea.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

US Treasury Sanctions 3 Lazarus Group Members

Shalini Nagarajan

North Korean hacker group Lazarus made attempts to move funds worth $63 million that were stolen from last year’s <a href="https://blockworks.co/news/defi-cross-chain-horizon-bridge-hacked-for-100m">Harmony bridge hack</a>, but the crypto exchanges used for the process claim its transfers have been blocked.



Blockchain sleuth ZachXBT <a href="https://twitter.com/zachxbt/status/1614771861266792449" target="_blank" rel="noreferrer noopener">shared</a> on Twitter that the group moved some 41,000 ETH over the weekend using Ethereum-based Railgun, a smart contract that keeps user identities private, to exchanges Binance, OKX and Huobi. The transactions were carried out between Jan. 13 and 14.



ZachXBT also shared over 350 addresses associated with the hacker group.&nbsp;



Binance CEO Changpeng Zhao <a href="https://twitter.com/cz_binance/status/1614887319177428992" target="_blank" rel="noreferrer noopener">tweeted</a> that the exchange has previously detected the hacker’s fund movement, and that it coordinated with Huobi in freezing the accounts. They also together managed to recover 124 bitcoin ($2.6 million), according to Zhao, implying that some of the stolen ether was swapped for bitcoin.



Huobi too was able to detect and prevent the hacker from attempting to launder funds, <a href="https://twitter.com/justinsuntron/status/1614901672102465538" target="_blank" rel="noreferrer noopener">according to</a> Justin Sun. About Capital, Sun’s investment firm, <a href="https://blockworks.co/news/huobi-founder-sells-100-stake-to-justin-sun-fund-report">acquired Huobi in October</a>.&nbsp;



Harmony’s Horizon bridge was one of the biggest hacks of last year. It allows users to move their cryptoassets via cross-chain transfers between Ethereum, Binance Smart Chain and Harmony blockchains. The bridge was exploited in June 2022 for $100 million, with <a href="https://blockworks.co/news/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service">the proceeds initially moved</a> via now-OFAC-sanctioned <a href="https://blockworks.co/tag/tornado-cash">Tornado Cash</a>.&nbsp;



Blockchain analytics firm Elliptic <a href="https://hub.elliptic.co/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack/" target="_blank" rel="noreferrer noopener">said</a> that different types of cryptoassets were stolen including ETH, BNB, USDT, USDC and Dai. After the theft, the hacker used different types of decentralized exchanges to swap the tokens for ETH, which is a “common technique utilized by DeFi hackers,” the firm added.&nbsp;



The<a href="https://blockworks.co/news/crypto-hacks-2022"> total amount of funds lost to hacks in 2022</a> amounted to $4.3 billion of cryptocurrency, representing a 37% jump from 2021. Smart contract vulnerabilities that lead to malicious exploits remain among the most pressing threats that need to be solved in 2023.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

North Korea’s Lazarus Hackers Try to Exfiltrate Harmony Funds

<div id="highlights-block_627586bdeb65b" class="highlights">
 <ul>
 <li>North Korean mixer Blender.io was used to conceal funds from the Ronin Network hack</li>
 <li>The Treasury has already sanctioned the group the FBI said is responsible for the largest cryptocurrency hack to date</li>
 </ul>
 
</div>



The US Treasury Department has levied its first sanctions against a crypto mixing service, or a means of obscuring the origin of a digital asset. 



The Treasury on Friday alleged North Korea-based hacker Lazarus Group — which in March allegedly <a href="https://cms.blockworks.co/fbi-says-north-korea-behind-625m-ronin-hack/" target="_blank" rel="noreferrer noopener">stole $625 million</a> from Ethereum-linked sidechain Ronin Network — used the sanctioned company, Blender.io, to conceal the illicit funds.



Blender was used to launder more than $20.5 million of the hacked cryptocurrency, the Treasury said in a <a href="https://home.treasury.gov/news/press-releases/jy0768" target="_blank" rel="noreferrer noopener">statement</a>. The attack remains the largest crypto hack on record. 



“Virtual currency mixers that assist illicit transactions pose a threat to U.S. national security interests,” said Brian Nelson, under secretary of the Treasury for terrorism and financial intelligence. “We are taking action against illicit financial activity by the DPRK and will not allow state-sponsored thievery and its money-laundering enablers to go unanswered.”



In April, the Treasury in its first move <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">sanctioned Ethereum addresses</a> linked to Lazarus Group.



The news comes as the digital asset industry continues to evaluate the role and risks of <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">mixer services</a>. Hackers used mixing service Tornado Cash to try to conceal 5,400 stolen ether linked to April’s $80 million <a href="https://cms.blockworks.co/hacked-crypto-platform-offers-no-questions-asked-10m-bounty-for-stolen-funds/" target="_blank" rel="noreferrer noopener">Fei Protocol hack</a>, according to BlockSec Chief Technology Officer Lei Wu.



The services, while known to be often linked to money laundering, are not illegal.



“There are legitimate privacy concerns that [mixers] can help address,” Kim Grauer, director of research at Chainalysis, said during a panel at the <a href="https://cornellblockchain.org/" target="_blank" rel="noreferrer noopener">Cornell Blockchain Conference</a> in New York. “There is a lot of hacking happening, which is another bad impact of growing so fast, but there&#8217;s also an opportunity there to build more secure platforms.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

blender.io

US Treasury Sanctions First Crypto Mixing Service Following Record Hack

<div id="highlights-block_625dcee381ae5" class="highlights">
 <ul>
 <li>The Lazarus Group and APT38 have been named as those responsible for the theft</li>
 <li>Exploiters used hacked private keys to forge withdrawals on March 23, Ronin said</li>
 </ul>
 
</div>



The US Federal Bureau of Investigation has placed &#8220;cyber actors&#8221; from North Korea at the heart of last month&#8217;s $625 million hack on the Ethereum-linked sidechain Ronin Network.



Through an investigation, the agency said it was able to &#8220;confirm&#8221; hacker collectives Lazarus Group and APT38 are responsible for the theft of hundreds of millions of dollars in crypto, a Thursday <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea" target="_blank" rel="noreferrer noopener">statement</a> reads.



Exploiters, according to Ronin, used <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">hacked private keys</a> to forge withdrawals on March 23. The breach wasn’t discovered until several days later, when a user was unable to withdraw 5,000 ETH.



State-sponsored Lazarus has been accused of multiple digital asset-based hacks, including a year-long endeavor beginning in 2017 in which the group reportedly managed to siphon off <a href="https://thenextweb.com/news/cryptocurrency-attack-report" target="_blank" rel="noreferrer noopener">$571 million</a>.



The Treasury Department last week <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">sanctioned the hacking collective</a> and the Ethereum address allegedly behind the theft.



As part of its efforts to combat blockchain-related crime, the FBI established a new unit last month led by Eun Young Choi, a former senior counsel to the deputy attorney general.



The group, along with APT38, operates at the behest of the Democratic People&#8217;s Republic of Korea (DPRK) under dictator Kim Jong Un. The isolated northern nation on the Korean Peninsula is strangled by economic sanctions and threatened by military encirclement from Western allies over its continued use of nuclear arms.



Cryptocurrency is viewed by some experts as a means to circumvent capital controls and economic sanctions, as well as to hide the wealth of North Korea&#8217;s political elite. It has also been speculated it is one of several mechanisms that fund Kim&#8217;s heavily sanctioned regime.



&#8220;The FBI&#8230;will continue to expose and combat the DPRK’s use of illicit activities – including cybercrime and cryptocurrency theft,&#8221; the statement said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

APT38

North Korean Hackers Responsible for Last Month’s Ronin Theft, FBI Confirms

<div id="highlights-block_625864ffa2d06" class="highlights">
 <ul>
 <li>US Treasury department alleges that North Korea-based Lazarus Group is behind the theft</li>
 <li>Ronin is still in the process of recovering funds, it said</li>
 </ul>
 
</div>



The Office of Foreign Assets Control has sanctioned Lazarus Group, the North Korea-based hacker the US Department of the Treasury claims is responsible for the $625 million Ronin Bridge hack in March. 



On Thursday, the <a href="https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220414" target="_blank" rel="noreferrer noopener">Treasury department announced</a> that the ethereum address, which wallet profiler Nansen has labeled “Ronin Bridge Exploiter,” allegedly behind the hack was added to the Specially Designated Nationals And Blocked Persons List (SDN).&nbsp;



Ronin Network, an Ethereum-linked sidechain used for blockchain gaming group Axie Infinity, was <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">breached</a> in late March for roughly $600 million, or <a href="https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96" target="_blank" rel="noreferrer noopener">173,600 ether</a>, and $25.5 million USDC.&nbsp;



At time of publication, the wallet address holds $445.3 million, according to <a href="https://etherscan.io/address/0x098B716B8Aaf21512996dC57EB0615e2383E2f96" target="_blank" rel="noreferrer noopener">Etherscan</a>. The hackers have been moving funds around since the breach occurred, data shows.&nbsp;



The exploiter used hacked private keys to forge withdrawals on March 23, according to a <a href="https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w" target="_blank" rel="noreferrer noopener">statement</a> from Ronin at the time. The breach was discovered nearly a week after the hack when a user was unable to withdraw 5,000 ETH.



The hackers tried to sell about 6,500 stolen ETH in March, transferring the tokens to three different exchanges, according to William Quigley, co-founder of stablecoin Tether and non-fungible token (NFT) blockchain platform WAX. All of the stolen USDC was transferred out to various wallets and DeFi protocols, Etherscan data shows.



Earlier this month, Sky Mavis, the company behind the Ronin Network bridge, <a href="https://cms.blockworks.co/axie-infinity-developers-made-some-trade-offs-that-enabled-625m-ronin-breach/" target="_blank" rel="noreferrer noopener">announced</a> it had raised $150 million to help reimburse affected users. And in a <a href="https://axie.substack.com/p/funding?s=r" target="_blank" rel="noreferrer noopener">blog post</a>, Axie Infinity admitted it had “made some trade-offs” that enabled the hack to take place.&nbsp;



Data shows that more than 3,000 ETH, or about $9.9 million, was moved from the wallet Wednesday into <a href="https://etherscan.io/address/0x1bf53ce80ff2ed5711b8a2db8f7ea5b38da118d6" target="_blank" rel="noreferrer noopener">another address</a> that then transferred the ETH in increments of 100 to several different wallets.&nbsp;



“We are still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk,” representatives from Ronin wrote in a community update <a href="https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w" target="_blank" rel="noreferrer noopener">post</a> on Thursday. “Expect the bridge to be deployed by end of month.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

lazarus group

Newsletter

Blockworks Research