Lazarus Group Footprints All Over Major Crypto Attacks Including CoinEx

North Korean hacking collective Lazarus has significantly increased its activities recently, reports from blockchain tracking company Elliptic reveal. In the last three months alone, they have been connected to five significant cryptocurrency breaches.

CoinEx, a major global cryptocurrency platform, faced the group’s most recent attack, losing an estimated $54 million. Cumulatively, Lazarus has siphoned nearly $240 million in cryptocurrencies in a mere span of 104 days.

Elliptic stated, “Our analysis confirms that a portion of the CoinEx loot ended up in an address previously linked to the Lazarus group. This address was involved in the theft from Stake.com, the crypto casino founded by Ed Craven, although it took place on another blockchain.” This confirmation follows last week’s FBI declaration, which blamed Lazarus for $41 million crypto heist from Stake.

Online crypto detective, ZachXBT, shared a similar sentiment earlier this week. He mentioned on Twitter about the CoinEx attacker inadvertently linking their address to the Stake incident.

The sequence of events saw the perpetrator channeling the stolen assets to Ethereum via a bridge historically associated with Lazarus. Following this, the loot was sent to a wallet address known to be in the hacker’s possession. Notably, a large chunk of these funds came from the Tron and Polygon blockchains.

Furthermore, Elliptic unveiled that in their operations, Lazarus blended their funds with addresses previously spotted during the Stake theft. They even used an address connected to the Atomic wallet breach in June, which amounted to $100 million.

Given this pattern of blockchain movement and lacking any contrary evidence, Elliptic’s research team believes that Lazarus was likely behind the CoinEx heist.