North Korean state-sponsored hacking group Lazarus potentially responsible for stealing $100 million by compromising cryptocurrency wallet platform Atomic Wallet in June 2023 · 01.06.2023
The North Korean state-sponsored hacking group Lazarus stole $100 million in cryptocurrency assets by compromising user wallets on the decentralised cryptocurrency wallet service Atomic Wallet in early June 2023. Atomic Wallet supports a wide range of popular cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), Ripple (XRP), and others. The company determined that less than 1% of its monthly active users had been affected by the hack.
Researchers at blockchain analytics firm Elliptic attributed the incident on 6 June 2023 to the Lazarus Group “with a high level of confidence” pointing to similarities in laundering techniques observed in previous attacks associated with Lazarus.
On 22 August 2023, the FBI warned cryptocurrency companies of a possible USD 40 million transfer of cryptocurrencies by North Korean TraderTraitor-affiliated actors, also known as Lazarus, which are linked to cyberattacks on cryptocurrency companies. In the same warning, the FBI also attributed the cyber incident on cryptocurrency companies Alphapo, CoinsPaid and AtomicWallet to the Lazarus hacking group.
Sources cited by EuRepoC (32)
Show 27 more
North Korea’s Lazarus Group Likely Responsible For $35 Million Atomic Crypto Theft · 2023-06
North Korea’s Lazarus Group Likely Responsible For $35 Million Atomic Crypto Theft
https://hub.elliptic.co/analysis/north-korea-s-lazarus-group-likely-responsible-for-35-million-atomic-crypto-theft/
Targeting of Atomic Wallet cryptocurrency users · Jun 2023
North Korean hackers stole over $100 million in cryptocurrency from over five thousand cryptocurrency wallets run by a company called Atomic Wallet.
Atomic Wallet · 2 June 2023
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2023: Victim: Atomic Wallet; Date: 2 June; Amount (USD equivalent): 121m; Location: Estonia
Atomic Wallet · June 2, 2023
...and the $100 million theft of virtual currency from Atomic Wallet on June 2, 2023.
Atomic Wallet · on or about June 2, 2023
...and approximately $100 million of virtual currency from Atomic Wallet on or about June 2, 2023.
Atomic Wallet - REKT · 06/02/2023
Excerpt: Atomic Wallet blew up earlier this month. Even after two weeks, no official root cause has been announced, and the team's past attitude to security raises concerns. Will they ever admit what went wrong? Do they even know? | Article date: 06/16/2023
12th June – Threat Intelligence Report · 2023-06-12
The Estonia-based cryptocurrency wallet service Atomic Wallet has confirmed a cyber-attack that compromised customers’ wallets, resulting in the loss of more than 35M dollars. Researchers suggest with high confidence that the North Korean state-backed Lazarus Group is responsible for the attack.
Atomic Wallet hack; proceeds swapped into USDC and other stablecoins · In 2023
In 2023, North Korean operatives hacked the Atomic Wallet, withdrew approximately $100 million worth of crypto assets, swapped those assets into USDC and other stablecoins, and then swapped that USDC into other assets. As TRM Labs put it, "[t]his type of activity is a hallmark of recent" exploits by Lazarus Group [Case No. 1:26-cv-05445, U.S. District Court for the Southern District of New York; filing: COMPLAINT against Circle Internet Financial LLC, Circle Internet Group, Inc..]
Atomic Wallet user thefts · Aug 2, 2023 (as shown on page; incident June 2023)
Elliptic has attributed this incident to North Korea's Lazarus Group, which is believed to have stolen over $2 billion in cryptoassets across multiple thefts.
Atomic Wallet user thefts (first estimate) · Aug 2, 2023 (as shown on page; June 3rd incident)
Elliptic analysis of the thief's transactions leads us to attribute this hack to North Korea's Lazarus Group, with a high level of confidence.
Atomic Wallet exploit · published 2024-01-24 (June 2023)
In June 2023, thousands of users of Atomic Wallet ... leading to estimated losses of $129 million. The FBI later attributed this attack to North Korea-affiliated hacking group TraderTraitor
Atomic Wallet breach (June 2) · published 2023-09-13
CertiK has identified transactions connecting the Atomic Wallet, Alphapo, CoinsPaid, Stake.com, and CoinEx breaches, serving as on-chain evidence of Lazarus Group's involvement.
Atomic Wallet · 03/06/2023
The developers of Atomic Wallet investigate reports of large-scale theft of cryptocurrency from users' wallets, with over $35 million in crypto reportedly stolen. The North Korean threat actors from the Lazarus Group are believed to be behind the attack. [Date Occurred: 03/06/2023; Date Discovered: 03/06/2023]
“아토믹 월렛 해킹 대규모 자금 탈취 ‘북한 라자루스’ 소행” · 2023-06-07
attribution sentence(s): 최근 유명 암호화폐 지갑에서 대규모 자금을 탈취한 사건이 북한 해킹조직 라자루스의 소행으로 보인다는 분석이 나왔습니다. | 자금 추적 결과 과거 라자루스의 자금 세탁 수법과 정확히 일치했다는 지적입니다. | 탈중앙형 암호화폐 지갑인 ‘아토믹 월렛’에서 해킹을 통해 암호화폐 자산을 대거 탈취한 사건의 배후에 북한이 있는 것으로 분석된다고 블록체인 데이터 분석업체 일립틱(Elliptic)이 밝혔습니다.
Atomic Wallet · 3 June 2023
Para 143: “On 3 June, Atomic Wallet, an Estonia-based non-custodial decentralized wallet, confirmed that it had received reports of compromised wallets. A cybersecurity company assessed that the Lazarus Group was responsible ... Additional reporting from the same company illustrated that more than $100 million was stolen from over 5,500 compromised wallets. ... In response to the Panel’s enquiry, Estonia replied that the case was under investigation.”