{"id":545172,"date":"2023-01-29T20:05:05","date_gmt":"2023-01-29T17:05:05","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/north-korean-hackers-launder-27m-eth-from-harmony-bridge-attack\/"},"modified":"2023-01-29T20:05:05","modified_gmt":"2023-01-29T17:05:05","slug":"north-korean-hackers-launder-27m-eth-from-harmony-bridge-attack","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/north-korean-hackers-launder-27m-eth-from-harmony-bridge-attack\/","title":{"rendered":"# North Korean hackers launder $27M ETH from Harmony Bridge attack"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_84 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a2809b5845ae\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a2809b5845ae\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/north-korean-hackers-launder-27m-eth-from-harmony-bridge-attack\/#%E2%80%9D_North_Korean_hackers_launder_27M_ETH_from_Harmony_Bridge_attack_%E2%80%9C\" >&#8221; North Korean hackers launder $27M ETH from Harmony Bridge attack &#8220;<\/a><\/li><\/ul><\/nav><\/div>\n<h1><span class=\"ez-toc-section\" id=\"%E2%80%9D_North_Korean_hackers_launder_27M_ETH_from_Harmony_Bridge_attack_%E2%80%9C\"><\/span>&#8221; North Korean hackers launder $27M ETH from Harmony Bridge attack &#8220;<span class=\"ez-toc-section-end\"><\/span><\/h1>\n<p><img decoding=\"async\" src=\"https:\/\/images.cointelegraph.com\/images\/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjMtMDEvZWY4YzNmMjYtZGU3MC00MTc0LWE3OWYtNzQwMTZhYWI3YjIyLmpwZw==.jpg\" \/><\/p>\n<div class=\"post-content\" data-v-5a4050f8>North Korean exploiters behind the Harmony Bridge attack continue to launder the funds stolen in June 2022. According to on-chain data revealed on Jan. 28 by blockchain sleuth ZachXBT, the perpetrators moved another $27.18 million in Ethereum (ETH) over the weekend.<\/p>\n<p>The tokens were transferred to six different crypto exchanges, <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/zachxbt\/status\/1619489550233133056\">noted<\/a> ZachXBT in a <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">Twitter<\/a> thread, without disclosing which platforms had received the tokens. Three main addresses carried out the transactions. <\/p>\n<p>According to ZachXBT, exchanges were notified about the funds transfer and part of the stolen assets were frozen. The movements made by the exploiters to launder the money were very similar to those taken on Jan. 13, when over $60 million was laundered, noted the crypto detective. <\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Who\u2019s active rn? <\/p>\n<p>DPRK just finished laundering another $17.7m+ (11304 ETH) from the Harmony Bridge hack.<\/p>\n<p>S\/o to the exchanges who responded quickly on a weekend so funds could be frozen. <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/sUyUScHR4N\">pic.twitter.com\/sUyUScHR4N<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/zachxbt\/status\/1619489550233133056?ref_src=twsrc%5Etfw\">January 29, 2023<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>The funds were moved a few days after the Federal Bureau of Investigation (FBI) confirmed the Lazarus Group and APT38 as the criminals behind the $100 million hack. In a statement, the FBI noted that \u201cthrough our investigation, we were able to confirm that the Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $100 million of virtual currency from Harmony\u2019s Horizon bridge.\u201d<\/p>\n<p><strong><em>Related: \u2018Nobody is holding them back\u2019 \u2014 North Korean cyber-attack threat rises<\/em><\/strong><\/p>\n<p>The Harmony Bridge facilitates transfer between Harmony and the Ethereum network, Binance Chain and Bitcoin. A number of tokens worth about $100 million were stolen from the platform on Jun. 23.<\/p>\n<p>Following the exploit, 85,700 Ether was processed through the Tornado Cash mixer and deposited at multiple addresses. On Jan. 13, the hackers started shifting around $60 million worth of the stolen funds via the Ethereum-based privacy protocol RAILGUN. According to an analysis from crypto tracking platform MistTrack, 350 addresses have been associated with the attack through many exchanges in an attempt to avoid identification.<\/p>\n<p>Lazarus is a well-known hacking syndicate that has been implicated in a number of key crypto industry breaches, including the $600 million Ronin Bridge hack last March.<\/p>\n<p><template data-name=\"subscription_form\" data-type=\"defi_newsletter\"><\/template><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong>\n<\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> articles, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/general\/\" target=\"_blank\" rel=\"noopener\">General category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/cointelegraph.com\/news\/north-korean-hackers-launder-27m-eth-from-harmony-bridge-attack\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8221; North Korean hackers launder $27M ETH from Harmony Bridge attack &#8220; North Korean exploiters behind the Harmony Bridge attack continue to launder the funds stolen in June 2022. According to on-chain data revealed on Jan. 28 by blockchain sleuth ZachXBT, the perpetrators moved another $27.18 million in Ethereum (ETH) over the weekend. The tokens&#8230;<\/p>\n","protected":false},"author":1,"featured_media":545173,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/s3.cointelegraph.com\/uploads\/2023-01\/ef8c3f26-de70-4174-a79f-74016aab7b22.jpg","fifu_image_alt":"","footnotes":""},"categories":[1],"tags":[74868,70944,33897,27926],"class_list":["post-545172","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-defi","tag-hackers","tag-money-laundering","tag-north-korea"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/545172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=545172"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/545172\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/545173"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=545172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=545172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=545172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}