Orbit

Orbit Chain

Tornado Cash

Tornado

Source: AdobeStock / Tamara 
Blockchain analysts from Match Systems have found that the <a href="https://cryptonews.com/news/orbit-chain-hacker-swaps-stolen-usdt-for-eth-rakes-in-1-45-million-profits.htm">Orbit Chain</a> hackers used the same tactics as those in several other high-profile attacks – suggesting that a cybercrime organization, possibly the infamous Lazarus Group, stands behind these hacks. 
This criminal group seems to have been busy last year. Cointelegraph <a href="https://cointelegraph.com/news/orbit-hacker-may-have-also-performed-coinspaid-coinex-hacks-onchain-experts">cited</a> a January 3, 2024, report by Match Systems, naming <a href="https://cryptonews.com/news/north-koreas-lazarus-group-suspected-37-million-hack-coinspaid.htm">Coinspaid</a>, <a href="https://cryptonews.com/news/coinex-crypto-exchange-hit-by-28-million-exploit-four-hot-wallets-drained.htm">Coinex</a>, and <a href="https://cryptonews.com/news/atomic-wallet-hackers-hide-35-million-stolen-crypto-funds-using-thorchain-heres-what-you-need-know.htm">Atomic Wallet</a> among the group’s victims. 
Per the report, 
“[The analysis] gives reason to believe that the same criminal group may be involved in the hacking of the Orbit bridge, which in 2023 had previously committed several large hacks of the cryptocurrency services Atomic wallet, CoinsPaid, CoinEx, etc., using tools and patterns of the well-known Lazarus group.” 
As the new year approached, hackers <a href="https://cryptonews.com/news/orbit-suspends-cross-chain-bridge-contract-after-82m-exploit.htm">exploited</a> Orbit Bridge, the cross-chain bridging service of a South Korean-based multi-asset Orbit Chain, making off with $82 million. 
Read more:&nbsp;<a href="https://cryptonews.com/news/are-hackers-two-steps-ahead-of-security-in-a-cat-and-mouse-game-experts-answer.htm">Are Hackers Two Steps Ahead of Security in a Cat-and-Mouse Game? Experts Answer</a> 
<h2 id="common-threads">Common Threads</h2> 
 The analysts found that the hackers used Tornado Cash. They had gas funds from other accounts that <a href="https://etherscan.io/tx/0x5e35f4b1886d62543cc027b5c0ef54aac3901a25c37d8ea6b1ab8861c9bd09dd">withdrew them</a> from the popular crypto mixer. 
A mixer does ‘mixes’ different funds in order to obscure the trail leading back to the original sources. Therefore, hackers use it to mix their identifiable funds with others’ funds. 
That said, Match System reportedly ‘de-mixed’ the funds using specialized software. It analyzed the “characteristics and patterns before and after the Tornado.cash mixer, considering transaction volumes and dates/times, as well as other specialized methods.” 
What the team discovered was a group of addresses. One of them used the SWFT protocol to transfer funds to other addresses. The protocol was also used in the DFX Finance, Deribit, and AscendEX attacks. 
Following the Oribit attack, a portion of the funds sent through SWFT traveled through a number of chains, gathering in a <a href="https://cryptonews.com/news/cybersecurity-firm-dwallet-labs-discovers-fixes-500-million-vulnerability-tron-network.htm">Tron</a> wallet. It was then transferred to an exchange and cashed out. 
Another common factor, the analysts argue, is that the attackers used Avalanche Bridge and Sinbad in the Orbit attack and several earlier attacks. 
Per the team, 
“[These are] tools and patterns of the well-known Lazarus group.” 
Read more: <a href="https://cryptonews.com/news/blockchain-association-sues-ofac-over-sanctions-on-tornado-cash.htm">Blockchain Association Sues OFAC Over Sanctions on Tornado Cash</a> 
<h2 id="lazarus-was-responsible-for-a-fifth-of-total-losses-in-2023">Lazarus was Responsible for a Fifth of Total Losses in 2023</h2> 
 The North Korea-affiliated hacker group&nbsp;<a href="https://cryptonews.com/news/report-lazarus-group-deploys-new-kandykorn-malware-in-crypto-exchange-attack.htm">Lazarus</a> was responsible for $308.6 million stolen in 2023, the major bug bounty and security services platform <a href="https://cryptonews.com/news/immunefis-november-crypto-losses-show-343m-lost-to-frauds-and-hacks-cefi-platforms-account-for-53-losses.htm">Immunefi</a> found. This is a whopping 17% of the total year losses. 
The group was allegedly behind the high-profile attacks on&nbsp;<a href="https://cryptonews.com/news/atomic-wallet-announces-bug-bounty-program-1-million-up-for-grabs.htm">Atomic Wallet</a>,&nbsp;<a href="https://cryptonews.com/news/elliptic-blockchain-surveillance-firm-north-korean-lazarus-group-theft-spree-reaches-240-million-104-days.htm">CoinEx</a>,&nbsp;<a href="https://cryptonews.com/news/data-shows-north-korean-lazarus-group-accumulated-bitcoin-valued-over-40m.htm">Alphapo</a>,&nbsp;<a href="https://cryptonews.com/news/fbi-identifies-north-korean-lazarus-group-as-culprit-behind-41-million-stake-casino-hack.htm">Stake</a>,&nbsp;<a href="https://cryptonews.com/news/north-koreas-lazarus-group-suspected-37-million-hack-coinspaid.htm">CoinsPaid</a>, and the massive&nbsp;<a href="https://cryptonews.com/news/north-koreas-lazarus-group-behind-axie-infinitys-ronin-hack-say-us-treasury-fbi.htm">Ronin Network</a>&nbsp;attack, resulting&nbsp;in a $625 million loss. Source: Immunefi 
The Immunefi team recently <a href="https://downloads.ctfassets.net/t3wqy70tc3bv/EhGU8jztu6R938dcMfI9Q/b8e6bf8f6bdba576e547875abd916414/Immunefi_Lazarus_Group_Report.pdf">published</a> a report focusing specifically on the Lazarus Group. It found that, between 2021 and 2023, the group stole $1,903,600,000 across the Web3 ecosystem. 
In December, Immunefi CEO Mitchell Amador commented that, 
“As we approach 2024, their escalating sophistication is concerning. Their proficiency in exploiting infrastructure vulnerabilities, smart contract weaknesses, as well as their meticulous social engineering operations, underscores their emergence as perhaps the most pressing threat to web3 today.” 
Read more: <a href="https://cryptonews.com/news/record-losses-in-web3-may-be-coming-as-crypto-prices-rise-immunefi.htm">Record Losses in Web3 May Be Coming as Crypto Prices Rise: Immunefi</a>

Orbit Bridge Hacker Suspected in Coinspaid and Coinex Breaches

Table of Contents

Cryptonews.com

Other articles published on Jan 4, 2024

US Bitcoin Holdings Soar! Government Plans Massive $1.8 Billion Auction

Will SEC Approve or Reject Bitcoin ETF : Bloomberg Analyst Weighs In

Internet Computer Protocol (ICP) Price Will Rise By 150% in 20 Days, Here’s Why

Decentralized Crypto Exchange dYdX Publishes Report on $9 Million Hack

Major Taiwanese Crypto Exchange Under Investigation For Alleged NT$1 Billion Fraud

Bitcoin Long-Term Holders Stand Strong Despite Recent Crypto Market Selloff

Join our free newsletter for daily crypto updates!