North Korean Hackers Turning to Russian Exchanges to Launder Stolen Crypto: Chainalysis

According to a Sept. 14 report from on-chain analytics provider Chainalysis, the total amount of cryptocurrency stolen is estimated at $3.54 billion.

North Korea “continues to be an incubator for hacking activities and remains one of the largest active threats in the cybercrime landscape,” it stated.

Moreover, the Democratic People’s Republic of Korea (DPRK)-linked hacking groups are “increasing their use of Russia-based exchanges known to launder illicit crypto assets.”

🧵 Here’s a quick summary of our findings today on North Korean hackers’ usage of Russian services. https://t.co/WUoGzNEacB

— Chainalysis (@chainalysis) September 14, 2023

2023 NK Stolen Crypto Down from 2022

The revelations come in the same week that Vladimir Putin and Kim Jong-Un held military talks. The alarm has been raised over the DPRK’s evolving cybercrime tactics and sophisticated attacks used to fund its missile program.

The data revealed that $21.9 million in cryptocurrency from the Harmony Protocol hack was recently transferred to a Russian exchange known for laundering.

“This latest action marks a significant escalation in the partnership between the cyber underworlds of these two nations.”

It added that the prospect of recovering stolen funds from uncooperative Russian exchanges was “particularly grim.”

Moreover, the value of stolen crypto associated with North Korean hacking groups such as Lazarus currently exceeds $340 million this year.

However, this is much less than last year’s total of over $1.65 billion in stolen funds. 2022 was prolific for DPRK hackers, with extremely large attacks such as the $600 Million Axie Infinity theft.

Additionally, North Korea-linked groups still account for almost 30% of all crypto stolen in hacks this year. This year’s lower figures don’t necessarily indicate improved security or reduced criminal activity, said Chainalysis.

“We’re only one large hack away from crossing the $1B threshold in 2023.”

DeFi Hacks Ongoing

We are only halfway through September, yet it is shaping up to be a big one for DeFi exploits and hacks. Though they are not necessarily attributed to North Korean hacking collectives.

According to the De.Fi Rekt database, there have been seven substantial hacks, exploits, or scams in crypto so far this month.

The largest is the $52 million CoinEx exchange exploit on September 12. Other protocols losing funds this month include Stake Wallet, FloorDAO, and Coindroplet.

This week, CryptoPotato reported that transactions connecting the breaches at Atomic Wallet, Alphapo, CoinsPaid, Stake.com, and CoinEx had Lazarus Group involvement.