Lazarus, a North Korea-linked hacking group, has once again made headlines as the FBI confirms their involvement in the theft of $41 million in cryptocurrency from Stake.com. This recent attack highlights the group’s adeptness in targeting the digital realm and their continued threat to the security of organizations involved in the cryptocurrency space.
Lazarus’ Theft from Stake.com
Amidst the surge in cryptocurrency values, Lazarus orchestrated a sophisticated cyber heist and walked away with a staggering $41 million. The stolen amount comprised approximately $15.7 million in Ethereum and another $25.6 million in Binance Smart Chain (BSC) and Polygon. These substantial thefts serve as a reminder that cybercriminals are actively targeting high-value assets within the crypto landscape.
Identification of Lazarus as the culprit
Following the attack on Stake.com, cryptocurrency security researcher ZachXBT voiced suspicions that the Lazarus group may be involved. His investigation into the incident caught the attention of the FBI, leading to their confirmation of Lazarus’ responsibility for the theft. This revelation solidifies the group’s reputation for conducting large-scale cyberattacks and raises concerns about their ability to evade detection.
Movement of stolen funds
As part of the FBI investigation, it was discovered that the cyber actors associated with Lazarus had swiftly transferred the stolen funds from Stake.com. These transfers involved the movement of stolen cryptocurrency from the Ethereum, BSC, and Polygon networks. The ability of Lazarus to swiftly shift funds showcases their sophistication and knowledge of blockchain technology.
FBI’s response and guidance
In an effort to aid in the prevention of further fraudulent transactions, the FBI has published a list of virtual currency addresses linked to Lazarus’ criminal activities. The agency advises organizations to avoid engaging in any transactions involving these addresses. By raising awareness of these addresses, the FBI hopes to curtail additional crypto thefts and limit the funds available to Lazarus.
North Korea’s social engineering campaign
In a destabilizing move, GitHub recently exposed a social engineering campaign linked to North Korea that targeted accounts within the blockchain, cryptocurrency, and online gambling sectors. This campaign bears similarities to Lazarus’ modus operandi and adds to concerns about the state-sponsored group’s escalating activities. It underscores the need for enhanced cybersecurity measures within these industries.
History of Lazarus’ Cyber-Heists
Lazarus has gained infamy for its involvement in a series of high-profile cyber heists. Notably, in 2016, they orchestrated the theft of $81 million from the Bangladesh Bank’s account at the New York Federal Reserve Bank. This operation demonstrated their ability to execute sophisticated attacks on international financial institutions. The recurring pattern of Lazarus’ successful campaigns underscores their resilience and adaptability.
Lazarus’ Shift to Cryptocurrency Exchanges
Since 2018, Lazarus has shifted its focus to cryptocurrency exchanges, recognizing the potential for significant financial gains within this vulnerable sector. With their deep understanding of cryptocurrency networks and the vulnerabilities present in exchange platforms, the group has consistently targeted organizations within this industry. Their relentless pursuit of ill-gotten gains is reflected in their ongoing attacks against exchanges.
Total virtual currency theft by Lazarus
The FBI reveals a staggering figure – Lazarus has stolen over $200 million in virtual currency this year alone. This astounding sum showcases the extent of their financial impact on the cryptocurrency ecosystem and emphasizes the urgent need to bolster defenses against the group’s activities.
Recent attacks attributed to Lazarus include
In recent months, Lazarus has executed several audacious attacks, further underscoring their capability and determination. Among the notable incidents are the $60 million theft from Alphapo, the $37 million heist from CoinsPaid, and the $100 million breach of Atomic Wallet. These incidents demonstrate the group’s readiness to exploit vulnerabilities and take advantage of the lucrative opportunities presented by the cryptocurrency world.
The Lazarus hacking group’s involvement in the theft of $41 million in cryptocurrency from Stake.com serves as a stark reminder of the persistent threat they pose. With the FBI confirming their North Korean origins, it is evident that Lazarus continues to evolve, adapt, and exploit technological advancements in pursuit of illicit gains. To combat the growing menace, it is imperative for organizations within the cryptocurrency sphere to enhance their cybersecurity measures and remain vigilant against sophisticated cyber threats like Lazarus.