Share this article
North Korean Hackers Used Tornado Cash to Launder $12M From Heco Bridge Hack: Elliptic
The hacking group sent more than 40 transactions to Tornado Cash over the past 24 hours.
Updated Mar 14, 2024, 4:00 p.m. Published Mar 14, 2024, 3:58 p.m.
North Korean hackers tied to its infamous Lazarus Group have used coin mixing service Tornado Cash to launder $12 million worth of ether over the past 24 hours.
Research from blockchain analytics firm Elliptic shows that more than 40 transactions have been sent by Lazarus Group to Tornado Cash on March 13 and March 14. Elliptic has also attributed a $100 million Heco Bridge and HTX hack last November to Lazarus Group.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
Lazarus is responsible for hacks worth more than $3 billion over the past six years, according to a report by cybersecurity firm Recorded Future.
Tornado Cash was hit by U.S. sanctions in August 2022. This spurred Lazarus Group to use another mixer, Sinbad, to obfuscate their ill-gotten gains. However, Sinbad itself was seized by U.S. authorities in November, prompting Lazarus to make the shift back to Tornado Cash, Elliptic said in its blog post. One of Tornado Cash's founders, Roman Storm, was arrested last year and is awaiting trial on money laundering charges. Another, Roman Semenov, has been charged but has yet to be arrested.
Despite being sanctioned twice, Tornado Cash still runs via decentralized smart contracts that cannot be seized or taken offline.
"The change in behavior and return to the use of Tornado Cash likely reflects the limited number of large-scale mixers now operating, thanks to law enforcement takedowns of services such as Sinbad.io and Blender.io," Elliptic said.
More For You
What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
Crypto Firm Tether Says It Wants to Take Over Italian Football Club Juventus
The issuer behind the most popular stablecoin said that if the bid succeeds, it prepares to invest $1 billion in the football club.
What to know:
- Tether said it aims to take over popular Italian football club Juventus FC.
- The firm proposed to acquire Exor's 65.4% stake in an all-cash offer, and intends to make a public offer for the rest of the shares.
- Tether reported net profits exceeding $10 billion this year, while its flagship token USDT is the world's dominant stablecoin with a $186 billion market capitalization.
Top Stories
