Revealed: How North Korean hackers launder stolen crypto

Published at: Sept. 4, 2020

British multinational security company BAE Systems and the Society for Worldwide Interbank Financial Telecommunication, or SWIFT, have published a report revealing how cybercriminals launder cryptocurrency. 

According to the study Follow the Money money laundering cases via crypto are still relatively small compared to the huge volumes of cash laundered through traditional methods like wire transfers.

But there are some notable examples and the report goes in-depth into the money laundering methods employed by Lazarus Group, a well-known hacking gang sponsored by the North Korean regime.

Lazarus typically steals the crypto funds from an exchange and then starts to pass transactions through different multiple exchanges using something called a “layering technique.”

The hackers employ East Asian facilitators who receive a portion of the stolen funds for helping launder the funds. These facilitators transfer crypto across numerous addresses they own to “obfuscate the origin of the funds,” said the study.

“Facilitators move a portion of the received funds through newly added bank accounts that are linked to their exchange account – this enables the conversion from cryptocurrency into fiat currency. Other stolen funds might be transferred in Bitcoin into prepaid gift cards, which can be used at other exchanges to purchase additional Bitcoin.”

Cointelegraph recently reported that Lazarus was reportedly attacking crypto and blockchain talent through major professional social network, LinkedIn.

Tags
Related Posts
Digital intelligence must overcome challenges to solving crypto crimes
While the value of cryptocurrencies has varied wildly in the last year, this has not diminished crypto’s attractiveness to criminals. Many of them are moving their illegal activities underground and outside the view of law enforcement. Because of the public nature of most blockchains, however, this rapid movement shouldn’t be a major concern to law enforcement agencies. With the right tools and training, following the proceeds of crypto-enabled crime is actually not as difficult as it may seem. However, intelligence agencies must have a cryptocurrency investigation plan that includes the right tools to lawfully collect digital evidence and the properly …
Technology / Aug. 20, 2021
Lazarus is attacking the crypto industry via LinkedIn, warns F-Secure
Lazarus, a group of hackers who are allegedly backed by North Korea, is now reportedly attacking crypto and blockchain talent through major professional social network, LinkedIn. According to a report by the Finnish cyber security and privacy firm, F-Secure, the latest Lazarus attack was made through a crypto-related job advert on the site. Their investigation indicated that an individual working in the Blockchain space received a phishing message that mimicked a legitimate Blockchain job listing. The message included an MS Word document titled “BlockVerify Group Job Description,” which executed malicious macro code when opened. F-Secure found that the document shares …
Technology / Aug. 25, 2020
Researchers Say Ransomware Attacks on the Rise as More People Work From Home
A study published by cybersecurity firm, Proofpoint, shows an increase in email-based phishing attacks used to deliver ransomware over the last few months. According to the report, first-stage deployments of ransomware are reportedly on the rise and have mostly been targeting the United States, France, Germany, Greece, and Italy. The attacks appear to be capitalizing on the influx of people now working from home amid the COVID-19 pandemic. Research additionally indicates that the ransom demands are very low compared to the amounts usually seen in these attacks. Lower than average ransoms A ransomware application called “Mr. Robot” has mostly targeted …
Technology / June 29, 2020
North Korea’s Crypto Extortion Efforts Have Expanded Considerably in 2020
A group of hackers associated with the North Korean regime have kept their crypto extortion efforts alive in 2020. A group of North Korean hackers operating under the name “Lazarus” targeted several crypto exchanges last year, according to a report published by Chainalysis. One of the attacks involved the creation of a fake trading bot which was offered to employees of the DragonEx exchange. Findings show that in March 2019, the hackers stole approximately $7 million in various cryptocurrencies from the Singapore-based exchange. Cybersecurity vendor Cyfirma warned in June about a massive crypto phishing campaign that could be launched by …
Bitcoin / July 28, 2020
North Korean Internet Use Spikes 300% as Regime Turns to Cryptocurrencies
North Korea’s internet use saw a 300% surge over the past three years, as the country’s regime has continued to rely on cryptocurrencies for various activities. Exploitation of crypto and blockchain technology is among the primary tactics for the country to generate revenue as well as transfer and use illicitly obtained funds, a new study says. Titled “How North Korea Revolutionized the Internet as a Tool for Rogue Regimes,” the study was released on Feb. 9 by Insikt Group, an intelligence arm of United States-based cybersecurity firm Recorded Future. The report analyzed North Korean senior leadership’s internet activity between Jan. …
Technology / Feb. 11, 2020