Hack (September 2019) · September 2019
Para. 158: "...launder proceeds from a July 2019 and a September 2019 hack, which resulted in the theft of approximately $272,000 and $2.5 million, respectively."
Algo Capital · 25 September 2019
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2019: Victim: Algo Capital; Date: 25 September; Amount (USD equivalent): 2m; Location: Gibralter
U.S.-based company hack (September 2019) · September 2019
As also alleged in the pleadings, in September 2019, a U.S.-based company was hacked in a related incident. The North Korea-associated hacker gained access to the company's virtual currency wallets, funds held by the company on other platforms, and funds held by the company's partners. The hacker stole nearly $2.5 million and laundered it through over 100 accounts at another virtual currency exchange.
Theft from Exchange 10, a U.S.-based company focused on the Algorand blockchain (stolen recovery seeds used to recreate wallets) · On or about September 25, 2019
"Exchange 10" is a U.S.-based company focused on the Algorand blockchain, which administers ALGO tokens, a form of virtual currency. On or about September 25, 2019, Exchange 10 was the victim of a theft of multiple virtual currencies in which hackers used stolen recovery seeds to recreate wallets owned by Exchange 10 and its partners ... In spite of the actors' use of VPN services to mask their location during this theft, law enforcement was able to trace logins to an IP address within North Korea. [Case No. 1:20-cv-02396, U.S. District Court for the District of Columbia; filing: COMPLAINT against 280 VIRTUAL CURRENCY ACCOUNTS]
actors: North Korea (per US v. 280 Virtual Currency Accounts forfeiture complaint)
Cluster 1LEvp ... is also connected to BTC addresses previously named in the above-referenced forfeiture complaint, see 1:20-cv-00606-TJK, and attributed to thefts by North Korea. In spite of the actors' use of VPN services to mask their location during this theft, law enforcement was able to trace logins to an IP address within North Korea.