Treasury Sanctions North Korean Hacker Group, Confirms Ties to $625M Theft

Hackers stole $625 million last month from the Ronin Network, a sidechain used for play-to-earn game Axie Infinity

article-image

Blockworks Exclusive art by axel rangel

share

key takeaways

  • US Treasury department alleges that North Korea-based Lazarus Group is behind the theft
  • Ronin is still in the process of recovering funds, it said

The Office of Foreign Assets Control has sanctioned Lazarus Group, the North Korea-based hacker the US Department of the Treasury claims is responsible for the $625 million Ronin Bridge hack in March. 

On Thursday, the Treasury department announced that the ethereum address, which wallet profiler Nansen has labeled “Ronin Bridge Exploiter,” allegedly behind the hack was added to the Specially Designated Nationals And Blocked Persons List (SDN). 

Ronin Network, an Ethereum-linked sidechain used for blockchain gaming group Axie Infinity, was breached in late March for roughly $600 million, or 173,600 ether, and $25.5 million USDC. 

At time of publication, the wallet address holds $445.3 million, according to Etherscan. The hackers have been moving funds around since the breach occurred, data shows. 

The exploiter used hacked private keys to forge withdrawals on March 23, according to a statement from Ronin at the time. The breach was discovered nearly a week after the hack when a user was unable to withdraw 5,000 ETH.

The hackers tried to sell about 6,500 stolen ETH in March, transferring the tokens to three different exchanges, according to William Quigley, co-founder of stablecoin Tether and non-fungible token (NFT) blockchain platform WAX. All of the stolen USDC was transferred out to various wallets and DeFi protocols, Etherscan data shows.

Earlier this month, Sky Mavis, the company behind the Ronin Network bridge, announced it had raised $150 million to help reimburse affected users. And in a blog post, Axie Infinity admitted it had “made some trade-offs” that enabled the hack to take place. 

Data shows that more than 3,000 ETH, or about $9.9 million, was moved from the wallet Wednesday into another address that then transferred the ETH in increments of 100 to several different wallets. 

“We are still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk,” representatives from Ronin wrote in a community update post on Thursday. “Expect the bridge to be deployed by end of month.”


Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

HYATT REGENCY SALT LAKE CITY

TUES, OCT. 8, 2024

Guided by the expertise of Blockworks Research Analysts team, this one day event will feature senior leaders, entrepreneurs, and developers from across the crypto industry. Attendees will have the opportunity to participate in an immersive experience to explore the latest trends, […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

avaxcover.png

Research

The Avalanche Network is well on its way to becoming the best platform to build high-performance blockchains that can seamlessly interact with each other, and the strong focus on performant and scalable blockchains will likely be Avalanche’s competitive advantage.

article-image

Assets under management in global crypto ETPs broke the $100 billion mark for the first time amid BTC price increases and persistent inflows

article-image

Bitcoin and ether stay flat post-selloff as SOL fans brace for a new all-time high

article-image

For the first time ever, Bitcoin’s halving comes right after a new all-time high

article-image

The company unveiled its research platform upgrades during the first day of Blockworks’ Digital Asset Summit in London

article-image

With this launch, Blockworks Research consolidates hundreds of features into one subscription model

article-image

After the capital infusion led by Jump Crypto, Pantera Capital and Lightspeed Faction, Figure also seeks to offer a registered security alternative to stablecoins