Atomic Wallet hack sees North Korea’s Lazarus Group pocketing $100M: report

Earlier this month, hackers attacked Atomic Wallet and stole over $35 million in an attack the wallet says only affected 1% of its users. Blockchain forensics firm Elliptic now reports that the hackers stole over $100 million and are laundering the funds on a Russian exchange.

Atomic Wallet acknowledged the attack on June 3 and, two days later, confirmed only 1% of its monthly active users were affected. It added that it was working with exchanges and blockchain analytics firms to trace and freeze the lost funds.

Elliptic, the London-based analytics firm, traced the lost funds to Lazarus Group, the hacker collective allegedly sponsored by North Korea. Initially, the company claimed the hackers had only managed to steal $35 million, but it has now found the damage was much bigger.

Reported losses from the @AtomicWallet hack are now over $100 millionhttps://t.co/pPYSfoAU6r

— Elliptic Investigations (@Elliptic_Inv) June 13, 2023

Since the hack, Elliptic investigators have been working with authorities to trace and recover the funds. This has led to over $1 million in stolen digital assets being frozen.

The freezing of the funds sparked a change in the hackers’ behavior, Elliptic says. The group is now allegedly using Garantex, a Russian exchange sanctioned by the U.S. Treasury last year, to launder the funds.

Treasury sanctioned Garantex in April 2022 after it was found that the exchange allowed criminals to launder over $100 million in proceeds from malware campaigns and darknet markets. Initially based in Estonia, Garantex moved to the Federation Towers in Moscow as global authorities began investigating the company. Despite the sanctions, the platform continues to operate.

Atomic Wallet has yet to give any update on the cause of the breach. However, it claims to have brought in New York blockchain forensics firm Chainalysis to assist with the investigations.

CEO Konstantin Gladych says they are working with police in the wallet’s homeland of Estonia. Authorities in Kazakhstan also sent a request for cooperation to the company, but nothing has come of the investigations at press time.

 Watch Gregory Ward: BSV blockchain is an absolute fit for cybersecurity