{"id":79783,"date":"2023-06-06T12:11:28","date_gmt":"2023-06-06T09:11:28","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=79783"},"modified":"2025-09-11T12:59:41","modified_gmt":"2025-09-11T09:59:41","slug":"elliptic-atomic-wallet-hacker-sent-assets-to-mixer-used-by-lazarus-group","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/elliptic-atomic-wallet-hacker-sent-assets-to-mixer-used-by-lazarus-group\/","title":{"rendered":"Elliptic: Atomic Wallet hacker sent assets to mixer used by Lazarus Group"},"content":{"rendered":"<p>Assets stolen in the <a href=\"https:\/\/forklog.com\/en\/news\/atomic-wallet-hack-losses-exceed-35-million\">Atomic Wallet breach<\/a>, totaling more than $35 million, are being laundered by the hacker through the Sinbad.io cryptocurrency mixer, Elliptic researchers found.<\/p>\n<blockquote class=\\\"twitter-tweet\\\" data-lang=\\\"en\\\">\n<p lang=\\\"en\\\" dir=\\\"ltr\\\">The $35 million stolen from <a href=\\\"https:\/\/twitter.com\/AtomicWallet?ref_src=twsrc%5Etfw\\\">@AtomicWallet<\/a> users is being laundered through Sinbad \u2014 the mixer fka(?) Blender and used heavily by NK&#8217;s Lazarus Group<a href=\\\"https:\/\/t.co\/UHCwfZiw8e\\\">https:\/\/t.co\/UHCwfZiw8e<\/a><\/p>\n<p>\u2014 Elliptic Investigations (@Elliptic_Inv) <a href=\\\"https:\/\/twitter.com\/Elliptic_Inv\/status\/1665755078001655808?ref_src=twsrc%5Etfw\\\">June 5, 2023<\/a><\/p><\/blockquote>\n<p> <script async src=\\\"https:\/\/platform.twitter.com\/widgets.js\\\" charset=\\\"utf-8\\\"><\/script><\/p>\n<p>In earlier investigations, experts determined that the service was actively used by North Korea&#8217;s Lazarus Group. Through Sinbad.io, funds linked to it totaling more than $100 million passed. This sum includes part of the assets from the <a href=\"https:\/\/forklog.com\/en\/news\/ronin-the-ethereum-sidechain-hacked-attacker-siphons-625-million\">Axie Infinity breach<\/a> of about $600 million and the <a href=\"https:\/\/forklog.com\/en\/news\/hacker-steals-about-100-million-in-harmonys-horizon-cross-chain-bridge-attack\">attack on the Horizon cross-chain bridge<\/a> with losses of $100 million.<\/p>\n<p>Elliptic did not disclose the amount of Atomic Wallet user assets sent to the mixer. The researchers only noted that the hacker had first converted all the cryptocurrencies into Bitcoin.<\/p>\n<p>According to the researchers, Sinbad is a clone of another mixer \u2014 Blender.io, through which the Lazarus Group also laundered funds. However, this service <a href=\"https:\/\/forklog.com\/en\/news\/blender-io-mixer-sanctioned-by-the-united-states\">was sanctioned by the U.S. Department of the Treasury<\/a> in May 2022.<\/p>\n<p>Elliptic researchers said they would continue to track the stolen Atomic Wallet assets in cooperation with the wallet team and other parties, including exchanges and crypto firms.<\/p>\n<p>In August, the U.S. Treasury <a href=\"https:\/\/forklog.com\/en\/news\/us-sanctions-tornado-cash-the-ethereum-mixer\">added to the sanctions list<\/a> the Ethereum mixer <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-tornado-cash-mixer-and-why-was-it-sanctioned\">Tornado Cash<\/a>. The agency accused the platform of facilitating the laundering of cryptocurrency from illicit sources totaling more than $7 billion.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Assets stolen in the Atomic Wallet breach totaling more than $35 million are being laundered by the hacker through the Sinbad.io mixer, Elliptic researchers found.<\/p>\n","protected":false},"author":1,"featured_media":79784,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1535,1125],"class_list":["post-79783","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-elliptic","tag-lazarus"],"aioseo_notices":[],"amp_enabled":true,"views":"19","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/79783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=79783"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/79783\/revisions"}],"predecessor-version":[{"id":79785,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/79783\/revisions\/79785"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/79784"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=79783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=79783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=79783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}