Stablecoin Issuers Freeze Nearly $5 Million Linked to Lazarus Group

The North Korean hacker group Lazarus Group has lost access to $4.96 million after stablecoin issuers blacklisted two of its addresses. The assets were identified by renowned on-chain sleuth ZachXBT.

Update: As of today all four stablecoin issuers (Paxos, Tether, Techteryx, Circle) have now blacklisted the two addresses below with $4.96M from Lazarus Group.

0x36f2D3871edd59d5C06DB8F0b12bE928d5922A70
0x12ED7f6ed0491678764c2b222A58452926E44DB6

Another $1.65M is frozen at… pic.twitter.com/dZSOltDRy4

— ZachXBT (@zachxbt) September 14, 2024

In a months-long investigation, ZachXBT tracked how the North Korean-affiliated organization laundered over $200 million in fiat and cryptocurrencies over approximately three years. The funds were stolen through 25 exploits on various blockchains.

The expert collaborated with teams from MetaMask, Binance, TRM Labs, and Five I’s LLC. As a result, companies behind the stablecoins USDT (Tether), USDC (Circle), TUSD (Techteryx), and BUSD (Paxos) froze the two wallets of the perpetrators. 

Besides nearly $5 million in stablecoins, the addresses contain $720,000 in DAI and $313,000 in Ethereum, which could not be frozen.

Additionally, $1.65 million of Lazarus Group’s funds have been frozen across various exchanges following the investigation.

ZachXBT noted that the community often criticizes Tether’s compliance practices. However, Circle took the longest to decide on the freeze, taking 4.5 months. The expert was surprised to find that despite having 1,000 employees, the USDC issuer lacks a dedicated hack response team to protect the ecosystem.

Earlier, Circle’s founder and CEO Jeremy Allaire announced the relocation of the firm’s global headquarters from Boston to New York.