Orbit Bridge reported an exploit of its Ethereum vault in which an unidentified attacker conducted six theft transactions affecting ETH, WBTC, USDT, USDC, and DAI with losses estimated at about $81.5 million. Orbit Chain said it worked with the Korean National Police Agency, KISA, Theori, and other authorities, halted the Ethereum vault to prevent further damage, and observed stolen assets swapped into ETH and DAI before being split across eight wallets.
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2023: Victim: Orbit Chain; Date: 31 December; Amount (USD equivalent): 81m; Location: ROK
Reported: 2023-12; Victims: Orbit Bridge; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Korea, Republic of
The article notes that the methodical transaction pattern suggested a possible Lazarus connection, but it frames the attribution as an assessment rather than a confirmed finding.
Ozys is also exploring the possibility of North Korea’s Lazarus Group being behind the attack.