Slow Mist: The suspected North Korean hacker group "Lazarus Group" has transferred some of the stolen Harmony funds to the Ethereum and Tron mixing networks

According to the analysis of SlowMist MistTrack, on January 16, the Harmony hacker withdrew funds from the BTC address of the exchange and began to transfer funds. After a few days of multi-layer transfers, part of the funds were transferred to the exchange again, and another part of the funds were cross-chained to the Avalanche chain through the Avalanche Bridge, and then converted to USDT/USDD after multiple cross-chains, and transferred to Ethereum and Tron respectively Mixed currency network. In this transfer, Lazarus Group is suspected to have used a new money laundering method. The cross-chain path is BTC Network——Avalanche——ETH Network (—— Tron Network). The tools used in the cross-chain include Avalanche Bridge, 1inch limit order, BitTorrent, etc. On June 23, 2022, the Harmony cross-chain bridge was attacked, with a loss of about $100 million. On January 13, the hacker began to transfer the funds withdrawn from Tornado Cash and recharged and withdrawn funds to the privacy network railgun, then transferred part of the funds to the exchange and withdrew to the BTC network. SlowMist MistTrack will continue to follow up and block the hacker address of this incident.