North Korea's Lazarus Group Launders $605M in Stolen Crypto on THORChain

The hacker behind the Bybit exploit, which resulted in the theft of over $1.4 billion worth of crypto on Feb. 21, has managed to launder over 50% of the stolen funds within a week. Despite the efforts of onchain analysts to identify the exploiters, the hacker has successfully laundered over $605 million worth of Ether (ETH), according to crypto intelligence platform Lookonchain.

North Korea's Lazarus Group has been identified as the main culprit behind the Bybit exploit by blockchain analytics firms, including Arkham Intelligence. The exploiters have used the crosschain asset swap protocol THORChain to launder the funds, leading to a significant increase in the protocol's swap volume. However, the use of THORChain's privacy-preserving features for illicit fund laundering has sparked controversy, with some industry watchers criticizing the protocol's role in the process.

Following the controversy, one of the leading THORChain developers, known only as "Pluto," announced his exit from the project. Pluto cited the protocol's failure to block North Korean hacker-linked transactions as the reason for his departure. Another THORChain validator, "TCB," also threatened to leave the project if a solution to stop North Korean flows was not rapidly adopted.

The FBI has urged crypto validators and exchanges to cut off the Lazarus Group and confirmed earlier reports that North Korea was behind the record Bybit hack. However, THORChain founder John-Paul Thorbjornsen has stated that none of the sanctioned wallet addresses listed by the FBI and the US Treasury's Office of Foreign Assets Control has ever interacted with the protocol. He also noted that it is unrealistic to expect these blockchains to censor, including THORChain, given the speed at which the actor is moving funds.