Historically, the Lazarus Group used popular crypto mixers like Tornado Cash to launder funds. However, as governments crack down on these services, moving large sums through them has become increasingly difficult.
Instead, the group is using a web of DeFi protocols, including decentralized exchanges (DEXs) and cross-chain bridges, to obfuscate transactions.
One of the key platforms involved is ThorChain, a decentralized cross-chain exchange.
The Bybit hackers have already bridged at least $6.2 million of stolen Ethereum (ETH) to Bitcoin (BTC) through ThorChain. They are also swapping ETH for DAI using OKX’s Web3 Swap.
The influx of illicit funds has driven ThorChain’s trading volume to an all-time high, surpassing $1 billion in daily transactions.
ThorChain metrics. Source: ThorChain explorer.
Meanwhile, another non-KYC DEX, eXch, has processed nearly $30 million in trading volume since the stolen funds began moving on Feb. 23.
Bybit suspects eXch has facilitated the laundering of over $90 million but says the platform has refused to block transactions tied to the hack.
Tracking Stolen Funds Becomes More Difficult
As hackers become more sophisticated, tracking stolen crypto has become a game of cat and mouse. The Lazarus Group is using thousands of intermediary addresses, layering transactions across multiple blockchains to break transaction trails.
According to Nick Carlsen, a former FBI analyst and TRM’s North Korea expert, the Bybit exploit is a clear example of North Korea doubling down on its “flood the zone” strategy.
By moving funds in rapid succession across different platforms, hackers aim to overwhelm blockchain analytics firms, compliance teams, and law enforcement. This high-volume, high-frequency tactic makes it significantly harder to trace the flow of stolen crypto.
While some stolen assets remain in transit, a sizable portion appears to be sitting idle—likely awaiting liquidation through over-the-counter (OTC) networks.
North Korea’s shift toward DeFi and high-volume laundering techniques underscores how rapidly crypto criminals are evolving, leaving authorities racing to keep up.
Prashant Jha is a seasoned crypto journalist based in Delhi, India, with a Bachelor’s Degree in Computer Science Engineering. Passionate about the evolving world of blockchain and cryptocurrencies, he has been a dedicated voice in the industry since 2018. Prashant’s expertise lies in regulatory reporting, where he unravels complex legal and financial developments with clarity and precision. Before joining CCN in 2024, he honed his craft at Cointelegraph, establishing himself as a trusted name in crypto journalism.
His coverage spans major industry events, including the high-profile collapses of FTX, Three Arrows Capital (3AC), and LUNA, offering readers insightful analyses of their regulatory and market implications. Prashant’s technical background enables him to bridge the gap between intricate blockchain technology and its real-world applications, making his work accessible to novices and experts.
Beyond his professional pursuits, Prashant is an avid music enthusiast, often exploring diverse genres to unwind. A sports lover, he has a particular passion for cricket and frequently engages in discussions about the game. His multifaceted interests and sharp journalistic instincts make him a valuable contributor to CCN, where he continues shaping the crypto landscape's narrative.
