US Officials Tie North Korea’s ‘Lazarus’ Hackers to $625M Crypto Theft
Axie Infinity’s Ronin blockchain suffered a massive exploit late last month.
The U.S. Treasury Department alleged that North Korean hacking group Lazarus is tied to a more than $600 million theft of cryptocurrency from the Axie Infinity-linked Ronin bridge.
The Treasury Department added an Ethereum address to its sanctions list on Thursday. Wallet profiler Nansen had labeled the sanctioned address as a “Ronin Bridge Exploiter” when checked by CoinDesk Thursday. It held 148,000 ETH at publication time. CoinDesk independently confirmed that the wallet is tied to the Ronin exploit.
Ronin Network said in a blog post that the FBI had linked Lazarus with the validator breach and that the Treasury Department sanctioned the funds.
“We are still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk,” the blog said, targeting deployment before month’s end and promising a full post-mortem at a later date.
Ronin – a sidechain that is connected to the main Ethereum blockchain but allows the developers behind play-to-earn game Axie Infinity, Sky Mavis, to support faster and cheaper transactions – was hacked last month, losing 173,600 ETH and 25.5 million USDC, worth $625 million at the time. It ranks among the largest exploits in crypto history.
Thursday’s action is the first time the Treasury's sanctions office has blacklisted an alleged Lazarus-held crypto wallet, a source in the tracing industry told CoinDesk.
A Treasury Department spokesperson said the department had worked with the FBI to investigate the Lazarus Group and Advance Persistent Threat 38 (another North Korean entity believed to use malicious programming to steal funds).
"Identification of the wallet will make clear to other VC actors, that by transacting with it, they risk exposure to US sanctions. This demonstrates Treasury’s commitment to use all available authorities to disrupt malicious cyber actors and block ill-gotten criminal proceeds," the spokesperson said. "There may be mandatory secondary sanctions requirements on persons who knowingly, directly or indirectly, engage in money laundering, the counterfeiting of goods or currency, bulk cash smuggling, or narcotics trafficking that supports the Government of North Korea or any senior official or person acting for or on behalf of that Government."
The spokesperson said anti-money laundering and countering the financing of terrorists were "critical" chokepoints in preventing money laundering with stolen funds, and called on the crypto industry to implement these types of safeguards.
UPDATE (April 14, 17:19 UTC): Adds information from Ronin blog post.
UPDATE (April 14, 17:25 UTC): Adds laundering estimate from Elliptic.
UPDATE (April 14, 21:45 UTC): Adds statement from U.S. Treasury Department.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.
Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.