Liquid

lazarus.day

Japanese cryptocurrency exchange Liquid reported a cyberattack in which its warm wallets were compromised and more than 70 different crypto assets were withdrawn. Follow-on tracking described stolen assets moving through centralized exchanges and DeFi swapping venues, with reported losses exceeding $90 million and investigators publishing addresses associated with the stolen funds.

tayvano/lazarus-bluenoroff-research

Amt Stolen: $91,000,000

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2021-08; Victims: Liquid; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Japan

US court filing via CourtListener RECAP: United States v. 1,168,679 In Funds Associated with Two Stablecoin Addresses on The Ethereum Network

For example, in August 2021, North Korean hackers stole approximately $90 million in virtual currency from Japan-based virtual currency exchange Liquid. [Case No. 2:24-cv-04640, U.S. District Court for the Central District of California; filing: COMPLAINT No Fee Required - US Government, filed by plaintiff UNITED STATES OF AMERICA.]

US court filing via CourtListener RECAP: United States v. APPROXIMATELY 1,159,834.52 USDT

For example, in or around August 2021, North Korean cyber actors stole approximately $90 million in virtual currency from Japan- based virtual currency exchange Liquid. [Case No. 1:25-cv-03771, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 1,159,834.52 USDT]

US court filing via CourtListener RECAP: United States v. APPROXIMATELY 13.98 MILLION USDT

For example, in or around August 2021, APT38 cyber actors stole approximately $90 million in virtual currency from Japan- based virtual currency exchange Liquid. [Case No. 1:25-cv-03943, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 13.98 MILLION USDT]

While we will refer to the attackers as North Korean-linked hackers more generally, many of these attacks were likely carried out by the Lazarus Group in particular. ... 67 different ERC-20 tokens, along with large quantities of Ether and Bitcoin, had been moved from these wallets to addresses controlled by a party working on behalf of DPRK.