North Korea accused of orchestrating $100 million Harmony crypto hack · 2022-06
North Korea accused of orchestrating $100 million Harmony crypto hack
https://therecord.media/north-korea-accused-of-orchestrating-100-million-harmony-crypto-hack/
Targeting of Harmony cryptocurrency bridge · Jan 2023
Lazarus Group stole nearly $100 million in cryptocurrency from the platform Harmony Bridge in June 2022. The FBI formally attributed the hack to Lazarus in January 2023 after the hackers attempted to launder nearly $60 million through cryptocurrency mixers and a series of wallets.`
Harmony Hack (Horizon Brigde Hack) · June
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel. RGB Unit: Lazarus Group; Case Name: Harmony Hack (Horizon Brigde Hack); VAS √; VAS Value: 85,500 ETH; Publicized Month: June. (SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures)
Harmony's Horizon bridge · reported on June 24, 2022
Through our investigation, we were able to confirm that the Lazarus Group (also known as APT38), cyber actors associated with the DPRK, are responsible for the theft of $100 million of virtual currency from Harmony's Horizon bridge reported on June 24, 2022. ... On Friday, January 13, 2023, North Korean cyber actors used RAILGUN, a privacy protocol, to launder over $60 million worth of ethereum (ETH) stolen during the June 2022 heist.
Theft from COMPANY-3, a U.S.-based company · in or around June 2022
Then, in or around June 2022, North Korean cyber actors stole approximately $105 million in virtual currency from COMPANY- 3, a U.S.- based company. [Case No. 1:24-cv-02826, U.S. District Court for the District of Columbia; filing: COMPLAINT against BITCOIN AND BTC.B SEIZED FROM EIGHT TRANSACTION HASHES AT CRYPTOCURRENCY BRIDGE-1]
Harmony Horizon bridge theft (defendant funds in two stablecoin addresses traced to it) · June 23, 2022
On June 23, 2022, North Korean hackers stole approximately $105 million worth of virtual currency from Harmony's virtual currency bridge, Horizon. A hacker-controlled Ethereum address ending in "DeD00" served as an initial consolidation point for stolen funds following the Horizon Bridge theft, and received approximately 85,870 stolen ETH that originated from the Horizon bridge. [Case No. 2:24-cv-04640, U.S. District Court for the Central District of California; filing: COMPLAINT No Fee Required - US Government, filed by plaintiff UNITED STATES OF AMERICA.]
Harmony theft · in or around June 2022
In or around June 2022, North Korean cyber actors stole approximately $105 million in virtual currency from [Harmony] ... The North Korean hackers who stole virtual currency from Liquid, Sky Mavis, Harmony, CoinsPaid, Alphapo, and Poloniex are part of an ongoing conspiracy [Case No. 1:25-cv-03771, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 1,159,834.52 USDT]
Harmony theft · in or around June 2022
In or around June 2022, APT38 cyber actors stole approximately $105 million in virtual currency from U.S. -based Harmony. [Case No. 1:25-cv-03943, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 13.98 MILLION USDT]
Harmony Bridge theft; proceeds laundered through Railgun (Kim v. Railgun DAO) · In late 2022 / In December of 2022 (as written in complaint)
In December of 2022, North Korean hackers stole hundreds of millions of dollars' worth of crypto assets. ... In late 2022, crypto hackers working for North Korea stole hundreds of millions of dollars' worth of crypto assets from a service called Harmony Bridge. North Korea immediately began to launder the stolen assets through centralized exchanges, bridges, and crypto mixers. [Case No. 1:26-cv-00179, U.S. District Court for the District of Columbia; filing: COMPLAINT against All Defendants with Jury Demand]
Horizon bridge theft, June 2022 · May 9, 2023 (as shown on page)
We now believe it is likely that North Korea's Lazarus Group was responsible for this theft, based on the nature of the hack and the subsequent laundering of the stolen assets.
Harmony cross-chain bridge attack (laundering continued in 2023) · June 23, 2022
Their activities, according to on-chain data, mainly involved laundering the cryptocurrencies stolen in 2022, including approximately $100 million taken in the Harmony cross-chain bridge attack on June 23, 2022.
Harmony Horizon bridge theft · reported on June 24, 2022
Through our investigation, we were able to confirm that the Lazarus Group (also known as APT38), cyber actors associated with the DPRK, are responsible for the theft of $100 million of virtual currency from Harmony's Horizon bridge reported on June 24, 2022.
“북한 해킹조직, 미국 블록체인 회사에서 1억 달러 규모 암호화폐 탈취” · 2022-06-30
attribution sentence(s): 북한 해킹 조직이 지난주 미국 블록체인 회사에서 1억 달러 규모의 암호화폐를 탈취했을 가능성이 제기됐습니다. | 최근 암호화폐 시장의 급격한 변동성에도 불구하고 암호화폐가 여전히 북한의 매력적인 목표라는 분석도 나왔습니다. | 북한 정권과 연계된 해킹 조직이 지난주 미국의 블록체인 관련 회사를 공격해 1억 달러에 달하는 암호화폐를 탈취한 배후로 지목됐습니다.
Horizon Bridge (Harmony blockchain) · 23 June 2022
Para 148: “According to numerous sources, the Horizon Bridge for the Harmony blockchain, which bridges Bitcoin, the ETH network and the Binance Chain, was compromised by a very similar cyberattack on 23 June 2022, in which multiple transactions were made to steal various types of Altcoins. ... The stolen assets were sent to different wallets in the Uniswap decentralized exchange for “coin swapping” into an assessed 85,800 ETH. ... On 29 June, based on the strong resemblance to previous cryptohacks by the group, including the Ronin hack, a blockchain analysis firm identified the Lazarus Group as the prime suspect. Investigations are ongoing.”
Harmony’s Horizon Bridge hack and laundering of proceeds · June 2022 (hack); 13 January 2023 (funds moved)
Para 165: “The hack of Harmony’s Horizon Bridge (June 2022) has been attributed to the Lazarus Group because of the methodologies used, which closely resemble those used in Axie Infinity’s Ronin network hack (March 2022). According to numerous sources, including several cybersecurity firms, on 13 January 2023 this group moved about half of the assets stolen in the Horizon Bridge hack, valued at $63.4 million in Ethereum [footnote 147: 41,000 ETH]. Railgun was used to deposit the funds in three different cryptocurrency exchanges. ... The exchanges involved blocked the transfers and froze the accounts, recovering 124 bitcoin in the process valued at $2.6 million at the time.”
actors: Lazarus Group (also known as APT38)
Lazarus Group (also known as APT38), cyber actors associated with the Democratic People's Republic of Korea, are responsible for the theft of $100 million of virtual currency from Harmony’s Horizon bridge