Connect with us

Blockchain

Lazarus Group $200M Crypto Laundering Explained

Published

2 years ago

on

Lazarus Group, a North Korean cybercrime syndicate, has recently orchestrated a massive $200 million cryptocurrency laundering operation using sophisticated techniques involving mixers and peer-to-peer (P2P) exchanges, thereby evading global tracking efforts. 

This article delves into the methods used and their implications for cybersecurity.

In-depth Analysis of Lazarus Group’s $200M Laundering Scheme 

Recent developments have implicated North Korea’s Lazarus Group in a massive $200 million cryptocurrency laundering operation. 

The Scheme intricately utilized cryptocurrency mixers and P2P exchanges to obscure the origins of stolen funds, presenting significant challenges to global financial security and law enforcement. 

Techniques Used in the $200M Crypto Laundering

Lazarus Group, a North Korean cybercrime syndicate, has recently orchestrated a massive $200 million cryptocurrency laundering operation using sophisticated techniques involving mixers and peer-to-peer (P2P) exchanges, thereby evading global tracking efforts. 

The Role of Cryptocurrency Mixers

Cryptocurrency mixers, or tumblers, play a crucial role in the laundering process. These services blend potentially identifiable or “tainted” cryptocurrency funds with others, making it challenging to trace the funds back to their source. By breaking the link between initial deposits and final withdrawals, mixers provide a layer of anonymity essential for illicit activities.

Investigations reveal that the Lazarus Group channeled substantial amounts of stolen funds through several prominent mixing services, thereby complicating the tracing process.

How Mixers Complicate Tracking

Tracking funds through a mixer involves sophisticated blockchain forensic techniques that sometimes lead to dead ends.

Following the trail requires law enforcement and blockchain analytics firms to differentiate between legitimate and illegitimate payments, which is made more difficult by the volume and anonymity of transactions processed by these mixers.

Utilization of P2P Exchanges

Parallel to using mixers, the Lazarus Group also extensively utilized P2P exchanges. These platforms facilitate direct transactions between users without a centralized authority, offering additional layers of anonymity. By conducting transactions on these platforms, often under fake identities, the group managed to convert mixed cryptocurrencies into new, less traceable forms.

Features of P2P Exchanges Anonymity

The inherent design of P2P exchanges emphasizes user privacy and minimal oversight, which benefits cybercriminals. These platforms often do not require extensive identity verification, allowing users to maintain high levels of anonymity.

Noones and Paxful were the Bitcoin P2P exchanges that were mainly used by Lazarus Group.

The infamous Lazarus Group has been identified as the orchestrator behind several high-profile cryptocurrency breaches in recent years. The FBI has linked the group to the $41 million attack on Stake.com, a gaming firm, as well as the $622 million exploit of the Ronin Bridge. In total, the group has amassed over $2 billion in stolen digital assets from its various heists.

With the help of industry leaders such as crypto exchange Binance and top Ethereum wallet MetaMask, ZachXBT has pinpointed multiple accounts believed to be connected to the Lazarus Group. These accounts allegedly received $44 million from Lazarus-led hacks and successfully laundered the stolen funds into fiat currency.

Challenges in Tracking Laundered Cryptocurrencies

The combined use of cryptocurrency mixers and P2P exchanges presents formidable challenges for law enforcement and blockchain forensic experts. 

Tracking the origins of funds becomes exponentially more complex as these technologies effectively break the links between the initial deposits and their final withdrawals. 

The sophistication of the Lazarus Group’s strategies highlights the ongoing arms race in digital forensics, necessitating advancements in investigative techniques to keep pace with such elusive cybercriminal tactics.

It underscores the need for international cooperation and stronger regulatory frameworks to monitor and control these decentralized platforms.

Global Impact and Response

lazarus group Lazarus Group $200M Crypto Laundering Explained

The global response to the Lazarus Group’s laundering operation has been one of alarm and mobilization. 

International Reactions to the Laundering Operation

Recognizing the need for a coordinated effort to combat the misuse of cryptocurrency platforms, governments, and international bodies have begun tightening regulations on digital currency exchanges to enforce compliance with anti-money laundering (AML) standards and know-your-customer (KYC) protocols.

The incident has catalyzed discussions at various global forums, focusing on enhancing the regulatory framework around cryptocurrencies.

These measures aim to decrease the anonymity associated with crypto transactions, making it harder for groups like Lazarus to exploit these platforms for illicit purposes.

Changes in Cryptocurrency Regulation Post-Lazarus Group

Post-Lazarus, the regulatory landscape is seeing significant shifts. Jurisdictions that previously adopted a laissez-faire approach to cryptocurrency regulation are reconsidering their stance. 

The focus has increasingly turned towards ensuring that exchanges and other crypto services adhere strictly to international AML guidelines. For instance, enhanced monitoring of suspicious transactions and the implementation of advanced tracking systems are being discussed as imperative steps to prevent similar incidents.

This incident has underscored the importance of global cooperation in the realm of financial technology. By sharing intelligence and aligning regulatory frameworks, countries can better prevent the flow of illicit funds through digital channels.

Technological Countermeasures

The field of cryptocurrency forensics is rapidly advancing, keeping pace with the complex strategies employed by cybercriminals like the Lazarus Group. 

Advances in Crypto-Forensic Tools

The field of cryptocurrency forensics is rapidly advancing, keeping pace with the complex strategies employed by cybercriminals like the Lazarus Group. 

Recent developments have emphasized the importance of sophisticated forensic technologies that can trace and identify illicit cryptographic activities more effectively.

Forensic specialists use a variety of techniques to track stolen or laundered cryptocurrency. 

These include pattern analysis, which scrutinizes the transaction patterns on the blockchain to identify suspicious activities, and address clustering, where related addresses are analyzed to determine connections between different transactions that may seem unrelated at first glance.

Another critical technique is transaction tracing. Every transaction recorded on the blockchain can be examined to follow the path of funds as they move through various wallets and exchanges. 

This method is crucial for mapping the journey of laundered money and potentially freezing involved assets to hinder further illicit activities, according to CNC Intelligence.

Enhancing Exchange Security Protocols

Beyond tracing and analysis, the role of exchanges has become increasingly pivotal in combating cryptocurrency crimes. 

Exchanges are now integrating more robust KYC (Know Your Customer) and AML (Anti-Money Laundering) regulations to prevent the misuse of their platforms. 

Per BDO, this includes real-time monitoring solutions provided by partnerships with blockchain analytics companies, which help identify and report suspicious transactions as they occur​​.

The evolution of blockchain forensics not only aids in immediate crime detection and prevention but also plays a significant role in shaping regulatory approaches toward cryptocurrency worldwide. 

The collaboration between forensic experts, regulatory bodies, and financial institutions is crucial for developing a secure and transparent crypto ecosystem​, as reported by CryptoGlobe.

Future Challenges and Strategies

As the cryptocurrency landscape continues to evolve, so does the sophistication of cyber threats. 

Preparing for Future Cyber Threats in Crypto

The Lazarus Group’s recent activities underscore the ongoing need for the crypto industry to stay ahead of cybercriminals through innovation and enhanced security measures. 

The industry faces the dual challenge of improving its defensive technologies while also educating users and regulators about the best practices for safeguarding digital assets.

Policy Recommendations for Enhanced Security

To combat future threats, policymakers and industry leaders must collaborate to create robust regulatory frameworks that balance security with innovation. 

It is also vital to improve worldwide coordination between law enforcement and intelligence agencies. 

To help stop possible security breaches before they occur, this involves exchanging best practices, information, and strategies for handling cyber threats.

The continuous refinement of blockchain forensics tools, coupled with proactive regulatory policies, will be pivotal in mitigating risks and ensuring the integrity of the cryptocurrency markets​.

Conclusion and Summary

This investigation into the Lazarus Group’s activities highlights the ongoing arms race in digital forensics. It underscores the need for advanced tools and international cooperation to combat sophisticated forms of money laundering effectively.

FAQs

  1. What are cryptocurrency mixers, and how do they facilitate laundering? Cryptocurrency mixers combine various streams of potentially identifiable cryptocurrency to obscure the origin of funds, making it difficult to trace illegal activities.
  2. How do peer-to-peer (P2P) exchanges increase anonymity? P2P exchanges allow users to trade cryptocurrencies directly with each other without the need for a centralized authority, often requiring less personal information, thus enhancing anonymity.
  3. What blockchain forensic techniques are used to track laundered cryptocurrencies? Techniques include pattern analysis, address clustering, transaction tracing, and exchange analysis, which help in identifying and linking suspicious transactions to real-world identities.
  4. What role do regulations play in preventing cryptocurrency laundering? Regulations enforce stricter KYC and AML protocols on exchanges and other crypto services to reduce anonymity and increase the traceability of crypto transactions.
  5. How can individuals and organizations protect themselves against crypto laundering? Adopting best security practices, using reputable exchanges, and staying informed about the latest in cryptographic technology can mitigate the risk of falling victim to such schemes.
Follow us on google news
Related Topics:

Continue Reading

Blockchain

Monolythium Introduces Public Testnet After Full Protocol Reset

Published

4 days ago

on

June 7, 2026

By


Monolythium Foundation Introduces Public Testnet for Post-Quantum Rust/RISC-V Layer 1

Monolythium Foundation today introduced the public testnet for Monolythium, a rebuilt Layer 1 blockchain designed as settlement infrastructure for autonomous agents, post-quantum accounts, native markets, and operator-cluster infrastructure.

The launch follows a full protocol reset. On April 28, 2026, Monolythium decommissioned its predecessor Cosmos-based app-chain, including its earlier EVM-bridged surface, legacy test network, operator software, launchpad, and explorer. The project chose to rebuild the protocol around autonomous economic activity carried out by humans, companies, software agents, and online services on open settlement rails.

Monolythium’s position is that the next phase of blockchain infrastructure will not be defined only by wallets sending tokens. Software agents are beginning to request services, pay for APIs, buy compute, open escrow, negotiate terms, and act under delegated authority. That requires more than generic smart contracts. It requires identity, consent, spending policy, reputation, service discovery, native markets, and dispute resolution enforced below the application layer.

“Monolythium was not rebuilt to become a slightly faster version of an existing EVM chain,” said Nayiem Willems, founder of Monolythium. “The reset was about removing assumptions that would have limited the protocol later. If autonomous agents are going to hold identities, spend funds, pay service providers, open escrow, and build reputation across platforms, the settlement layer underneath them needs different primitives from day one.”

The rebuilt protocol is not EVM-compatible at execution. Existing Solidity contracts and EVM bytecode do not run natively on Monolythium. The execution layer is Rust-first and compiled to deterministic RISC-V artifacts, while common settlement functions are handled through native protocol modules instead of repeatedly redeployed application contracts.

Those native modules include asset standards, name registration, account policy, issuer attestations, service discovery, availability, reputation, escrow, bridge policy, spending limits, and a protocol-level spot central limit order book, or CLOB. The native CLOB is intended to provide shared spot-market infrastructure for token pairs, stablecoin pairs, compute, data, agent services, real-world assets, and other marketable resources without requiring every market to depend on a separate bespoke contract.

Monolythium deliberately excludes perpetual futures and margin trading from the base protocol. The market layer is designed around spot settlement rather than leveraged derivatives. The project’s view is that agents paying for services, buying compute, routing liquidity, or managing treasury balances need predictable markets and final settlement at the protocol layer.

Post-quantum cryptography is built into the protocol from the start. Monolythium uses ML-DSA-65 for account and consensus signatures. User accounts, operator identities, and consensus certificates are based on post-quantum signatures rather than classical elliptic-curve signatures. The reason is structural: if an account or autonomous agent accumulates reputation, consent history, commercial activity, and attestations over years, its key material becomes part of its economic identity. Monolythium is designed so that identity does not begin with a future migration problem.

At the consensus layer, Monolythium uses Starfish-C, a DAG-BFT design organized around vertices, waves, and anchors. Anchors serve as the user-facing finality unit for payments, orders, escrow updates, bridge routes, and agent actions.

Monolythium also uses operator clusters instead of treating a network operator as a single key controlled by one party. Operators join clusters, clusters admit operators, and infrastructure quality becomes visible through network tooling. The model is intended to make region, reliability, hardware profile, archive capability, oracle support, and other service tiers part of the operator market.

The public testnet also includes LythiumSeal, Monolythium’s encrypted mempool research track. LythiumSeal is designed to keep sealed transaction bodies opaque until ordering is locked, reducing the visibility that can enable front-running and transaction-order manipulation. It is live on testnet, open source, opt-in, and research-stage.

Monolythium mainnet has not launched. The current release is a public testnet intended for developers, operators, and researchers.

About Monolythium

Monolythium is a Rust/RISC-V-native Layer 1 blockchain designed as settlement infrastructure for the autonomous economy. The protocol combines post-quantum account and consensus signing, Starfish-C DAG-BFT consensus, native asset standards, a native spot CLOB, agent-commerce primitives, operator clusters, and hardened node infrastructure.

Continue Reading

Blockchain

ERC-7943 Enters Final Status as Ethereum’s Framework for Real-World Asset Tokenization

Published

2 weeks ago

on

May 27, 2026

By

The Universal Real-World Asset (uRWA) standard is now specification-frozen and ready for production adoption across Ethereum and EVM-compatible networks

ERC-7943, the Universal Real-World Asset (uRWA) standard, has reached Final status within Ethereum’s formal standards process. The specification is now frozen – with its interface, error definitions, event signatures, and behavioral requirements fixed – and is available for production adoption across Ethereum and EVM-compatible networks.

ERC-7943 defines a minimal, vendor-neutral interface for the compliant tokenization of real-world assets. The standard addresses transfer validation, asset freezing, forced transfers, and enforcement actions without binding implementers to a specific identity provider, jurisdictional framework, or compliance stack. This approach enables institutions and developers to deploy regulated assets across jurisdictions while retaining flexibility over underlying compliance infrastructure.

“ERC-7943 gives institutions and developers a modular interface for compliance, transfer controls, and enforcement, so they can deploy regulated assets in any jurisdiction without depending on a single vendor’s stack,”

said Dario Lo Buglio, lead author of ERC-7943. “Compliance becomes pluggable since the standard separates the on-chain interface from the underlying KYC, sanctions, and jurisdiction logic.”

Final status represents the threshold for enterprise adoption in Ethereum’s standards process, as proposals may undergo substantial changes before reaching this stage. ERC-7943 attained Final status following multiple cycles of community review through Ethereum Magicians and the EIP working group. With the standard now finalized, institutions and infrastructure providers can build on a stable specification designed for long-term interoperability.

Early adoption is already underway. The Capital Markets and Technology Association (CMTA) has integrated ERC-7943 into recent releases of CMTAT, its open-source tokenization framework deployed in institutional initiatives globally. Chainlink has separately demonstrated compatibility through a public pull request tied to its Asset Compliance Engine (ACE). Brickken plans to integrate ERC-7943 into upcoming institutional infrastructure upgrades, with the standard expected to become the default framework across its product suite. These developments signal a transition from specification to active deployment across infrastructure and compliance environments.

The coalition supporting ERC-7943 has grown since its September 2025 announcement and now spans the full RWA stack, encompassing issuance platforms, infrastructure providers, exchanges, marketplaces, identity vendors, and audit firms. Backers and contributors include Bit2me, Brickken, Casper Network, CMTA, Compellio, Dekalabs, DigiShares, Forte Protocol, FullyTokenized, Propchain, RealEstate.Exchange, Stobox, and Zoth. Hacken and QuillAudits serve as security and audit partners.

The standard is open for adoption by issuers, infrastructure providers, and developers building tokenized financial instruments. Documentation, reference implementations, and community channels are available at erc7943.org. The full specification is published at eips.ethereum.org/EIPS/eip-7943.

About Bit2me

Bit2Me is the leading cryptoassets company in Spain, registered with the CNMV as a Crypto Asset Service Provider (CASP). The company has been building crypto infrastructure for more than 10 years and holds several cybersecurity and regulatory compliance certifications, including: ISO 27001 for Information Security Management; ISO 22301 for Business Continuity Management; ISO 37001 for Anti-Bribery and Corporate Ethics; ISO 37301 for Compliance Management Systems; UNE 19601 for Criminal Compliance Management Systems; and the CSA STAR Level 1 certification. https://bit2me.com/

About Brickken 

Brickken is a global leader in the tokenization of real-world assets, offering a comprehensive SaaS platform that enables businesses to tokenize equity, debt, and revenue-sharing models. By integrating traditional finance with blockchain technology, Brickken provides tools to simplify asset management, enhance investor engagement, and unlock liquidity. With over $500 million in tokenized assets and a presence in 30 countries, Brickken is at the forefront of innovation in asset tokenization. To learn more about Brickken, visit www.brickken.com/

About Compellio

Compellio SA is a deeptech company headquartered in Luxembourg providing global infrastructure components for bridging the gap between web2 and web3 computing. Based on its patented technology, Compellio works with public and private organisations in driving regulatory-compliant solutions across multiple industries. Compellio’s tokenisation platform enables developers to abstract away the complexity of smart contracts and build standardised interoperability frameworks for the lifecycle management of their physical, digital, and hybrid assets. For more information, visit https://compellio.com

About Dekalabs

Dekalabs is a Valencia-based software development and digital transformation consultancy specializing in cutting-edge blockchain solutions. With a multidisciplinary and senior technical team, they deliver bespoke services spanning mobile applications, web applications, corporate solutions, UI/UX, and artificial intelligence (dekalabs.com).

About DigiShares

DigiShares is a market-leading provider of white-label software for the compliant issuance, management, and trading of tokenized real-world assets. The platform enables asset owners and fund managers to fractionalize assets, onboard global investors at low cost, and provide peer-to-peer or exchange-based liquidity through integrations with regulated venues such as RealEstate.Exchange. With more than 200 clients worldwide, offices in the US and Denmark, a network of 80+ legal partners, and integrations across Ethereum, Polygon, and other EVM chains, DigiShares offers one of the most flexible and customizable solutions in the industry. See www.digishares.io. 

About Hacken

Hacken is an end-to-end blockchain security & compliance partner for digital assets. Unlike traditional providers, Hacken was born on blockchain. We combine deep Web3 expertise with enterprise-grade quality, AI-powered offensive security, and globally recognized certifications. Since 2017, Hacken has been trusted by 1,500 adopters including the European Commission, ADGM, MetaMask, Ethereum Foundation, and Binance to secure the new digital frontier. Visit www.hacken.io

About the Forte Protocol

The Forte Protocol is a next-generation blockchain infrastructure that unlocks tokenized economies, enabling developers to define, launch, and monetize their on-chain projects. Through its ecosystem of products and services, Forte Protocol is the infrastructure layer for safe, enduring digital economies that generate long-term value for developers and users. For more information, visit ForteFoundation.io

About FullyTokenized

FullyTokenized is a boutique development company specializing in custom blockchain, tokenization, and Web3 solutions. With a proven track record of delivering successful projects in highly regulated financial environments, including for Fortune Global 500 institutions, the company has contributed to projects representing more than $500M in tokenized value. FullyTokenized also empowers Web3 startups, helping them launch products in under 90 days and scale within the decentralized ecosystem. Visit https://www.fullytokenized.com to learn more.

About Propchain

Propchain is the technology vertical of Prop.com, building institutional-grade infrastructure for real estate financing and tokenized capital markets. Backed by Prop.com’s ~$150M in AUM and active operations across Europe and the UAE, Propchain connects real-world deal flow to digital rails for origination, compliant issuance, lifecycle servicing, investor reporting, and secondary distribution. The company is building one of the world’s first fully unified, standardized, verified data infrastructure layers for real estate—harmonizing operational, financial, and legal data into auditable records that enhance underwriting, monitoring, and transparency. Securitisations are issued out of Luxembourg, aligning with European regulatory frameworks and institutional best practice. Propchain’s product suite, including PropYield, is purpose-built to bridge high-quality real assets with modern market infrastructure, enabling scalable access to real estate yield while preserving rigorous compliance, governance, and data integrity.

About RealEstate.Exchange

RealEstate.Exchange (REX) is the world’s first licensed and regulated exchange purpose-built for tokenized real estate shares. REX combines decentralized finance technology with full compliance layers, enabling investors worldwide—both retail and institutional—to trade tokenized real estate shares directly from their self-custodial wallets. The platform offers instantaneous atomic-swap settlement, competitive listing fees, and a liquidity framework supported by the BRICK token. With its global legal network and partnerships with licensed entities, REX aims to become the go-to venue for secondary trading of tokenized real estate, see www.realestate.exchange. 

About Stobox

Stobox is a turnkey asset tokenization provider and technology company focused on building the infrastructure for compliant digital assets. It enables businesses and individuals to transform real-world assets into tokenized instruments that are transparent, liquid, and accessible. Core solutions include Stobox 4 for token issuance and management, the STV3 Protocol for compliant token frameworks, Stobox DID for digital identity, and the Stobox Oracle for real-world data integration. Its structured methodology supports issuers across every stage of the tokenization lifecycle, from legal readiness to fundraising and secondary markets. Companies benefit from streamlined access to capital and global investors, while investors gain exposure to previously illiquid opportunities. https://www.stobox.io/

About Zoth

Zoth is reimagining global finance with the world’s first full-stack, modular Stablecoin Operating System, enabling enterprises and institutions to launch stablecoins and tokenized RWAs 90% faster and 70% cheaper. Its core products include FAAST (compliant tokenization infrastructure), Stablecoin Studio (stablecoin-in-a-box), ZeUSD (yield-bearing stablecoin), and PayX7 (stablecoin payments infrastructure).

Zoth delivers a full-stack suite spanning tokenization, payments, and yield management, supported by BVI & CIMA-regulated fund structures across 127 countries. Recognized by Messari as a top player in PayFi and RWAFi, Zoth combines compliance, scalability, and innovation to power the future of real-world finance. Visit https://zoth.io/.

Continue Reading

Blockchain

LayerZero Blames Kelp Setup for $290M Exploit as Aave Fallout Deepens

Published

2 months ago

on

April 22, 2026

By

The fallout from the recent Kelp DAO exploit continues to ripple across the crypto ecosystem, with LayerZero pointing to a flawed system setup as the root cause of the attack.

Single Point of Failure Led to Exploit

LayerZero said the breach stemmed from how Kelp DAO configured its decentralized verifier network (DVN).

The attacker drained roughly 116,500 rsETH, valued at nearly $293 million, from Kelp’s LayerZero-powered bridge.

According to LayerZero:

  • Kelp relied on a 1/1 DVN setup, meaning only one verifier was used
  • This created a single point of failure
  • Prior recommendations to diversify verifiers were not followed

As a result, the attacker was able to exploit the system without needing to bypass multiple verification layers.

LayerZero Distances Itself

LayerZero stressed that the issue was not a flaw in its protocol, but rather how Kelp implemented it.

The company is now:

  • Urging all projects to adopt multi-DVN configurations
  • Warning it may stop supporting apps that continue using single-verifier setups

Aave Hit With $195M in Bad Debt

The impact quickly spread to Aave, where the attacker used stolen assets as collateral to borrow funds.

This led to:

  • Around $195 million in bad debt
  • A sharp drop in Aave’s total value locked
  • Billions withdrawn by users amid rising concerns

Liquidity issues have also emerged, especially around Ether-based lending pools.

Liquidity Risks Raise Alarm

Reduced liquidity on Aave is now creating additional risks.

Analysts warn that:

  • Markets are nearing 100% utilization
  • A 15% to 20% drop in Ether price could trigger further instability
  • Liquidations may fail under current conditions

To limit further damage, Aave has frozen rsETH markets across its platforms.

Who Covers the Losses?

With no clear recovery plan, debate has intensified over who should absorb the losses.

Suggestions from industry figures include:

  • Negotiating with the attacker for a partial return of funds
  • Using ecosystem funds to cover losses
  • Spreading losses across users
  • Attempting a rollback to pre-hack balances

Each option carries trade-offs, and no consensus has emerged.

Broader Implications for DeFi

The incident highlights how interconnected DeFi protocols can amplify risk.

A vulnerability in one protocol can quickly:

  • Spill into lending markets
  • Trigger liquidity crises
  • Impact multiple platforms simultaneously

Security Practices Under Scrutiny

LayerZero’s criticism of Kelp’s setup underscores a key lesson: security configurations matter as much as the underlying technology.

As protocols grow more complex, ensuring robust multi-layer verification systems may become essential to preventing similar exploits.

Continue Reading

Trending