DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

HTX

Date (as written)
2023-11
Year
2023
Country
Seychelles
Actors (as written)
Lazarus
Actor pages
Lazarus
Tags (as written)
FinancialGain Cryptocurrency
Dollar figures (as written)
USD 7.9 million; $23 million; $0; 30m; approximately $107 million; $107 million

Source entries (6)

lazarus.day

HTX · 2023-11
HTX was reported together with the HECO Bridge incident as a November 2023 compromise affecting a centralized exchange and bridge environment, with linked analysis describing the attack style as consistent with DPRK Lazarus Group activity. Subsequent reporting attributed the theft to Lazarus Group based on hack characteristics and fund movement, noting that stolen cryptoassets later began moving through Tornado Cash.
https://lazarus.day/incidents/htx/

EuRepoC

North-Korean state-sponsored hacking group Lazarus compromised hot wallet of Chinese crypto exchange HTX Global and stole USD 7.9 million worth of cryptocurrency on 24 September 2023 · 24.09.2023
North-Korean state-sponsored hacking group Lazarus compromised a hot wallet of Chinese crypto exchange HTX Global and stole USD 7.9 million worth of cryptocurrency on 24 September 2023, the Cyvers Alerts platform disclosed on 25 September. Shortly after, HTX Global's corporate advisor Justin Sun announced that the company offered the hackers a five percent reward of the total amount stolen if the hacker returned the stolen money. In March 2024 Blockchain cybersecurity firm Elliptic attributed the incident to the Lazarus-group and reported that more than $23 million from this attack was laundered by the group through mixer platform tornado cash.
Sources cited by EuRepoC (9)
https://twitter.com/CyversAlerts/status/1706301345223897506?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1706301345223897506%7Ctwgr%5E604098efcc9fb8fdeee1b48e3efcafaffeed1d41%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcointelegraph.com%2Fnews%2Fhuobi-global-crypto-exchange-hacked-report
https://twitter.com/justinsuntron/status/1706311251024822748
https://therecord.media/cybercriminals-stole-over-1-billion-from-crypto-funds-2023
https://securityaffairs.com/160525/breaking-news/lazarus-apt-returned-tornado-cash.html
https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions
Show 4 more
https://therecord.media/lazarus-group-north-korea-tornado-cash-money-laundering
https://securityaffairs.com/160586/breaking-news/security-affairs-newsletter-round-463-by-pierluigi-paganini-international-edition.html
https://therecord.media/north-korea-cryptocurrency-hacks-un-experts
https://www.yenicaggazetesi.com.tr/kuzey-koreden-milyon-dolarlik-kripto-para-vurgunu-798085h.htm

tayvano/lazarus-bluenoroff-research

HTX Theft · 2023-09-24
Amt Stolen: $0
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/htx.md)

UN Panel of Experts S/2024/215

HTX · 22 November 2023
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2023: Victim: HTX; Date: 22 November; Amount (USD equivalent): 30m; Location: Seychelles
https://undocs.org/S/2024/215

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

HTX · 2023-11
Reported: 2023-11; Victims: HTX; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Seychelles
https://data.mendeley.com/datasets/wwb2rzgfn7/2

US court filing via CourtListener RECAP: United States v. APPROXIMATELY 13.98 MILLION USDT

HTX (formerly Huobi) and HTX HECO Bridge heist; HTX employee socially engineered into running malicious application (CryptoOracle) from GitHub · On or about November 22, 2023 (social engineering from on or about November 10, 2023)
On or about November 22, 2023, North Korean cyber actors stole approximately $107 million in virtual currency from HTX and the HTX HECO Bridge. ... On or about November 10, 2023, an APT38 cyber actor socially engineered an employee at HTX and convinced that person to download and run a malicious application from a GitHub repository on the employee's work laptop. [Case No. 1:25-cv-03943, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 13.98 MILLION USDT]
https://storage.courtlistener.com/recap/gov.uscourts.dcd.286839/gov.uscourts.dcd.286839.1.0.pdf

Suggest a correction on GitHub