Hacker group laundered $147.5 million, involved in 97 crypto assets attack incidents.

Recently, a confidential United Nations report revealed a large-scale cryptocurrency money laundering incident. It is reported that a notorious hacker group stole funds from a cryptocurrency exchange last year and laundered $147.5 million through a virtual money platform in March this year.

The UN Security Council Sanctions Committee's inspector is investigating 97 cyber attack incidents against Crypto Assets companies that occurred between 2017 and 2024, involving amounts as high as $3.6 billion. This includes an attack that occurred at the end of last year, where a certain Crypto Assets exchange lost $147.5 million, which was subsequently laundered in March this year.

It is worth noting that a certain mixing platform was sanctioned in 2022, and the following year, two of its co-founders were accused of assisting in the money laundering of over $1 billion, involving cybercrime activities related to the hacker group.

According to a survey by cryptocurrency analysts, the hacker group laundered $200 million worth of crypto assets into fiat currency between August 2020 and October 2023.

In the field of cybersecurity, this hacker group has long been accused of carrying out large-scale cyberattacks and financial crimes. Their target range is extensive, covering multiple areas from banking systems to crypto assets exchanges, from government agencies to private enterprises. The following will focus on analyzing several typical attack cases, revealing how this hacker group successfully implemented these astonishing attacks through its complex strategies and technical means.

Social Engineering and Phishing Attacks

According to European media reports, the hacker group previously targeted military and aerospace companies in Europe and the Middle East, posting recruitment ads on social platforms to deceive employees and asking job seekers to download a PDF that had an executable file deployed, then executing phishing attacks.

Social engineering and phishing attacks both attempt to exploit psychological manipulation to deceive victims into lowering their guard and performing actions such as clicking links or downloading files, thereby jeopardizing their security.

Their malware enables attackers to target vulnerabilities in the victim's system and steal sensitive information.

In a six-month operation targeting a certain Crypto Assets payment provider, the gang used similar methods, resulting in the company being stolen from 37 million dollars.

During the entire event, they sent fake job opportunities to engineers, initiated distributed denial-of-service and other technical attacks, and submitted many possible passwords for brute force cracking.

Multiple Crypto Assets exchanges were attacked.

From August to October 2020, multiple cryptocurrency exchanges and projects were attacked, including a Canadian exchange, a certain blockchain project, and another exchange. These attacks resulted in losses ranging from $400,000 to $750,000.

The attacker transferred the stolen assets between multiple addresses through a series of complex fund transfers and obfuscation operations. By early 2021, these funds ultimately converged to the same address. Subsequently, the attacker deposited and withdrew a large amount of ETH using a certain mixing platform.

By 2023, after multiple transfers and exchanges, these funds ultimately gathered at the addresses for collecting funds from other security incident withdrawals and were sent to the deposit addresses of certain withdrawal platforms.

The founder of a mutual insurance platform was attacked by a Hacker.

On December 14, 2020, the founder's personal account of a certain mutual insurance platform was attacked, resulting in a loss of tokens worth 8.3 million dollars.

The attacker transferred and exchanged the stolen funds through multiple addresses, performing operations such as fund obfuscation, dispersion, and aggregation. Some of the funds were cross-chained to the Bitcoin network and then back to the Ethereum network, after which they were obfuscated through a mixing platform and finally sent to a withdrawal platform.

From December 16 to 20, 2020, the attacker sent over 2500 ETH to a certain mixing platform. A few hours later, another address began the withdrawal operation.

Afterwards, the attacker transferred part of the funds to the consolidated withdrawal addresses involved in the aforementioned incident through multiple transfers and exchanges. From May to July 2021, the attacker deposited 11 million USDT into a certain exchange's deposit address. From February to June 2023, the attacker sent a large amount of USDT to the deposit addresses of two different withdrawal platforms.

Latest Attack Incident Analysis

In August 2023, two new attack incidents occurred, involving a certain DeFi project and a certain Crypto Assets management platform. The attackers stole a large amount of ETH and transferred these funds to a certain mixing platform within the same month.

Subsequently, the attacker concentrated the funds extracted from the mixing platform into one address through a series of complex money transfer operations. In November 2023, these funds began to be transferred, eventually being sent to the deposit addresses of two commonly used withdrawal platforms through intermediaries and exchanges.

Event Summary

By analyzing this series of attack events, we can see the general operational pattern of this hacker group: after stealing Crypto Assets, they usually obscure the source of funds through cross-chain operations and the use of mixers. After obfuscation, they withdraw the assets to specific addresses and eventually send them to a few fixed addresses for withdrawal operations. Most of these stolen assets are deposited into certain specific withdrawal platforms, and then the Crypto Assets are exchanged for fiat currency through over-the-counter trading services.

Facing such large-scale and complex attacks, the Web3 industry is facing severe security challenges. Relevant institutions need to continuously monitor the dynamics of such hacker groups, deeply analyze their Money Laundering methods, to assist project parties, regulatory agencies, and law enforcement in more effectively combating such criminal activities and striving to recover stolen assets.