Slow Fog: The suspected North Korean hacker group "Lazarus Group" has transferred some of the stolen Harmony funds to Ethereum and Tron mixing networks

ChainCatcher news, according to SlowMist's MistTrack analysis, on January 16, the hacker from Harmony began transferring funds from the BTC address withdrawn from the exchange. After several days of multi-layer transfers, part of the funds was transferred back to the exchange, while another portion was cross-chain transferred to the Avalanche chain via Avalanche Bridge, and after multiple cross-chain transfers, it was exchanged for USDT/USDD, which were then transferred to the ETH/Tron chain mixing network.

In this transfer, the Lazarus Group is suspected of using a new money laundering method, with the cross-chain path being BTC Network -> Avalanche -> ETH Network (-> Tron Network). The tools used for cross-chain transfers include Avalanche Bridge, 1inch limit order, BitTorrent, etc.

Previously, on June 23 last year, the Harmony cross-chain bridge was attacked, resulting in a loss of approximately $100 million. On January 13, the hacker began transferring funds withdrawn from Tornado Cash and after recharging the privacy network Railgun, transferred part of the funds to the exchange and withdrew to the BTC network. SlowMist's MistTrack will continue to follow up and blacklist the hacker addresses involved in this incident.