The US apparently suspects North Korean hackers were involved in last month’s $622 million cryptocurrency heist at Ronin Network.
On Thursday, the US Treasury Department placed sanctions on the digital wallet the hackers used to loot the funds from Ronin Network. In doing so, the federal agency also tied the digital wallet to a notorious hacking group called Lazarus, which the US believes works for the North Korean government.
In addition, the Ronin Network claims the FBI has attributed the cryptocurrency heist to the Lazarus group. The FBI didn’t immediately respond to a request for comment, but the Ronin Network says it's been working with law enforcement agencies to retrieve the stolen funds.
Lazarus is perhaps best known for infiltrating Sony Pictures back in 2014. However, in recent years, the group has focused on stealing cryptocurrencies, possibly in an effort to help fund the North Korean government. The blockchain tracking firm Chainalysis estimates North Korean hackers stole at least $400 million in cryptocurrencies last year.
Ronin Network is the blockchain provider for the game Axie Infinity, which is popular in Asia. Late last month, the network lost 173,600 tokens in Ethereum after the hackers hijacked access to five “validator node” computers, which are used to authorize transactions.
Most of the stolen Ethereum tokens remain inside the sanctioned digital wallet. However, the hackers appear to be laundering some of the stolen cryptocurrency through a service called Tornado Cash. The sanctions from the US Treasury can impose both civil and criminal penalties on anyone who facilitates transactions to the Lazarus group. However, one of the founders of Tornado Cash claims it's “technically impossible" for sanctions to be enforced against its decentralized protocols, according to Bloomberg.
UPDATE: The FBI confirmed to PCMag it suspects North Korean hackers were behind the heist at Ronin Network.
"Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK (Democratic People's Republic of Korea), are responsible for the theft of $620 million in Ethereum reported on March 29th," the FBI said in a statement.
"The FBI, in coordination with Treasury and other US Government partners, will continue to expose and combat the DPRK’s use of illicit activities —including cybercrime and cryptocurrency theft— to generate revenue for the regime," the agency added.