North Korea used Tornado Cash to siphon HTX’s $147.5M loot: UN

As a researcher with a background in cybersecurity and cryptocurrencies, I find the use of privacy protocols like Tornado Cash by entities representing the North Korean regime to launder stolen cryptocurrency assets deeply concerning. The UN report accessed by Reuters detailing the Lazarus Group’s $147.5 million heist from HTX in 2023 and subsequent laundering through Tornado Cash is a stark reminder of the anonymizing power these services provide to cybercriminals, including state-sponsored actors.


As a crypto investor, I’ve come across reports suggesting that entities believed to be connected to the North Korean government employed the privacy protocol known as Tornado Cash to launder approximately $150 million worth of cryptocurrencies they had allegedly stolen last March.

Based on a confidential UN report obtained by Reuters, it is alleged that the notorious cybercriminal group known as Lazarus transferred cryptocurrency stolen in past attacks back to their base in North Korea.

In March 2023, North Korean cybercriminals illegally obtained approximately $147.5 million in cryptocurrencies from HTX, a crypto exchange managed by Justin Sun, the founder of Tron. By the following year, these funds were clandestinely routed to North Korea through Tornado Cash.

Crypto tumbling platforms like Tornado Cash serve as convenient solutions for nefarious individuals, including hackers and swindlers. They employ these services to shuffle and camouflage ill-gotten cryptocurrencies, making it difficult for investigators to trace the origin or ownership of the assets.

As a researcher examining recent cybercrime trends, I’ve come across some alarming information from the Reuters report. The United Nations is currently probing into no less than 97 suspected North Korean cyberattacks that successfully pilfered approximately $3.6 billion in cryptocurrencies between 2017 and 2024.

In 2024, the UN identified and probed into 11 separate incidents of cryptocurrency thefts with an estimated value of $54.7 million. These incidents were suspected to be linked to North Korean IT workers who had been unintentionally employed by small businesses within the crypto sector.

In 2022, the United States imposed restrictions on Tornado. Cash was accused of aiding North Korea in bypassing cross-border financial sanctions. Yet, the protocol and its creators denied these claims vehemently for more than two years.

As a financial analyst, I’d rephrase it as follows: On May 14th, I came across the news that Alexey Pertsev, the brainchild behind the cryptocurrency mixing platform Tornado Cash, was charged with money laundering offenses. This development could have significant ramifications for creators of open-source code in the crypto space.

Pertsev received a prison sentence of five years and four months for his alleged involvement in laundering approximately $1.2 billion of ill-gotten assets through the platform. His lawyers have been granted two weeks to file an appeal against this judicial decision.

As a crypto investor, I’ve come to understand that using Tornado Cash for laundering ill-gotten gains isn’t an exclusive practice of North Korean hackers. Instead, it’s a widely popular technique amongst the international hacking community.

On May 14, it was discovered by blockchain investigation firm PeckShield that stolen ether valued at $53 million from the Poloniex $100 million heist had been transferred to Tornado Cash.

North Korea used Tornado Cash to siphon HTX’s $147.5M loot: UN

A hacker transferred more than 17,800 Ether coins from six distinct digital wallets to a solitary Tornado Cash wallet, as depicted in the diagram above.

Read More

2024-05-15 15:39