Thread by @chainalysis

1/ Today at #AxieCon, Senior Director of Investigations @eeplante joins the @AxieInfinity team to deliver good news…

2/ With the help of law enforcement & leading orgs in the #crypto industry, more than $30M worth of #crypto stolen by North Korean-linked hackers has been seized.

In this thread, we discuss how the Chainalysis Crypto Incident Response team played a role. bit.ly/3x8Nq86

3/ Much of this is a result of our investigation following the March 2022 theft of more than $600M from Ronin Network, a sidechain built for the play-to-earn game Axie Infinity.

4/ The Chainalysis Crypto Incident Response helped with these seizures by utilizing advanced tracing techniques to follow stolen funds to cash out points and liaising with law enforcement and industry players to quickly freeze funds.

5/ Curious to know we did it? Here’s what we can share now.

6/ The attack began when the Lazarus Group gained access to five of the nine private keys held by transaction validators for Ronin Network’s cross-chain bridge. coindesk.com/tech/2022/03/2…

7/ They used this majority to approve two transactions, both withdrawals: one for 173,600 ether (ETH) and the other for 25.5 million USD Coin (USDC).

8/ They then initiated their laundering process – and Chainalysis began tracing the funds. The laundering of these funds has used over 12,000 different crypto addresses to date, which demonstrates the hackers’ highly sophisticated laundering capabilities.

9/ North Korea’s typical #DeFi laundering technique has roughly five stages. We can visualize it below using Chainalysis Reactor:

10/ However, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) recently sanctioned Tornado Cash for its role in laundering over $455 million worth of cryptocurrency stolen from Axie Infinity.

11/ Since then, Lazarus Group has moved away from the popular Ethereum mixer, instead using #DeFi services to chain hop, or switch between several different kinds of cryptocurrency in a single transaction.

12/ We can use Chainalysis Storyline to see an example of how Lazarus Group utilized chain-hopping to launder some of the funds stolen from Axie Infinity:

13/ Above, we see that the hacker bridged ETH from the Ethereum blockchain to the BNB chain and then swapped that ETH for USDD, which was then bridged to the BitTorrent chain.

14/ Cryptocurrency’s transparency is instrumental to investigating hacks like the one suffered by Axie Infinity. Investigators with the right tools can follow the money to understand and disrupt a cybercrime organization’s laundering activities.

15/ This seizure represents a huge milestone: The first time ever that cryptocurrency stolen by a North Korean hacking group has been recovered. Check out our latest blog for the full story. bit.ly/3x8Nq86