Infamous North Korean hacker group identified as suspect for $100M Harmony attack

A new report suggests that a notorious North Korea-affiliated hacking group may be behind last week’s $100 million Harmony attack.

The Lazarus Group, a well-known North Korean hacking syndicate, has been identified as the primary suspect in the recent attack that saw $100 million stolen from the Harmony protocol. 

According to a new report published Thursday by blockchain analysis firm Elliptic, the manner in which Harmony’s Horizon bridge was hacked and the way in which the stolen digital assets were consequently laundered bears a striking resemblance to other Lazarus Group attacks.

“There are strong indications that North Korea’s Lazarus Group may be responsible for this theft, based on the nature of the hack and the subsequent laundering of the stolen funds.”

Additionally, Elliptic outlined exactly how the heist was executed, noting that The Lazarus Group targeted the login credentials of Harmony employees in the Asia Pacific region to breach the protocol’s security system. After gaining control of the protocol, the hackers deployed automated laundering programs that moved the stolen assets late at night.

Elliptic also noted that the hackers have already transferred over 40% of the $100 million to Tornado Mixer, an Ethereum-based “mixing service” that obscures transaction data and makes it extremely difficult for investigators to trace the movement of funds.

Initially, the Harmony team offered up a $1 million bounty as an incentive for the hackers to return the funds. However, on June 29, Harmony upped the bounty to $10 million and claimed that a full return of funds would end the investigation and no further criminal charges would be pursued.

The $600 million Ronin bridge hack, which occurred in April, has also been linked back to The Lazarus Group. Due to current market conditions, the value of the stolen Ether (ETH) has plummeted more than 60% down to $230 million.

A recent report from Coinclub.com indicates that North Korea has deployed 7,000 full-time hackers to raise funds through cyberattacks, ransomware and crypto protocol hacks. North Korea is the world leader in cryptocurrency-related crime, with over 15 documented instances of cyber theft amounting to roughly $1.59 billion in stolen funds.

Related: Harmony hacker sends stolen funds to Tornado Cash mixer

Harmony’s Horizon bridge is the latest addition to a growing list of token bridges that have been attacked, including Meter, Wormhole and Ronin, bringing the total amount of bridge token-related theft to a little over $1 billion in 2022 alone.

The largest token bridge to be hacked was Poly Network in 2021, which lost $610 million, almost all of which has since been returned.