Connect with us

Coins

Bybit Funds on the Move, Could be Headed for Bitcoin Mixers ‘Next’: Elliptic

Published

on



North Korean hackers have started laundering stolen Bybit funds, with blockchain intelligence firm Elliptic tracking over $140 million in initial transactions designed to obscure the money trail.

The stolen funds are being systematically moved through anonymous exchanges before being converted to Bitcoin, a process that makes it harder to trace and recover the assets, the firm wrote in a blog post on Saturday.

“The second step of the laundering process is to ‘layer’ the stolen funds in order to attempt to conceal the transaction trail,” Elliptic wrote. “This transaction trail can be followed, but these layering tactics can complicate the tracing process, buying the launderers valuable time to cash out the assets.”

The $1.46 billion social engineering attack, which took place on Friday and consisted mostly of Ethereum, is the most significant theft in crypto history, surpassing the $611 million stolen from Poly Network in 2021. 

Elliptic and Arkham Intelligence have linked the attack to North Korea’s Lazarus Group, citing the use of decentralized exchanges and other services, including cross-chain bridges and coin swap services in a bid to throw off the scent.

“If previous laundering patterns are followed, we might expect to see the use of mixers next to further obfuscate the transaction trail,” it said. However, that may prove challenging due to the “sheer volume of stolen assets.”

Within hours of the theft, attackers distributed the stolen assets across 50 different wallets, each holding approximately 10,000 ETH. The funds are now being systematically emptied and converted to Bitcoin, according to Elliptic.

The attackers first converted stolen tokens like stETH and cmETH to Ethereum using decentralized exchanges, likely to avoid potential asset freezes. 

This matches Lazarus Group’s typical laundering playbook of converting stolen tokens to “native” blockchain assets before further obfuscation, Elliptic wrote.

To date, the group has stolen over $3 billion in crypto assets since 2017, reportedly funding North Korea’s ballistic missile program with the proceeds, according to a UN report last year, though that figure is suspected to be much higher, Elliptic noted.

As a result of the theft on Sunday, Bybit is now facing pressure from users’ withdrawals, who have since pulled roughly 23,000 BTC from Bybit’s hot wallet, data from Arkham Intelligence shows.

The exchange’s main wallets show its Bitcoin balance has dropped from 70,000 BTC to just over 52,000 BTC, indicating an outflow of roughly $1.7 billion since Friday afternoon.

Further analysis suggests Bybit has seen outflows totaling $6 billion across various crypto.

Anonymous crypto exchange blamed

Elliptic and others, including ZachXBT, have also pointed to anonymous crypto exchange eXch as having processed “tens of millions of dollars” in stolen assets from the hack despite direct requests from Bybit to block the activity.

“The stolen Ethereum is steadily being converted to Bitcoin, using eXch and other services,” Elliptic wrote Sunday.

A purported emailed response from eXch, archived on X on Saturday and cited by Elliptic, alleges the crypto exchange chose not to acknowledge requests from Bybit, claiming the latter has made “direct attacks on the reputation” against the former in the past.

“It is difficult for us to understand the expectation of collaboration” from an organization that has “actively undermined our reputation,” the email from eXch reads.

The exchange did not immediately respond to Decrypt’s request for comment.

In a post to a Bitcoin forum on Sunday, eXch claimed allegations it was facilitating money laundering were untrue.

“We are not laundering money for Lazarus/DPRK,” eXch wrote, claiming that such an allegation was the “perspective of some people that wish decentralized coins’ fungibility and on-chain privacy to vanish.”

It added: “The insignificant part of funds that was processed by us from the Bybit hack in an isolated case will be donated to various open-source initiatives dedicated to privacy and security both inside and outside crypto space.”

Edited by Sebastian Sinclair

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.



Source link

Coins

Alabama, Minnesota Advance Bitcoin Reserve Plans With Companion Bills

Published

on



Bitcoin could soon find a place on state balance sheets, with Alabama and Minnesota both pressing ahead with legislative frameworks for state Bitcoin reserves.

In Minnesota, House File 2946, also called the Minnesota Bitcoin Act, introduced by Rep. B. Olson (R-MN) on Tuesday, would allow the state to invest in Bitcoin directly. Its Senate counterpart, SF 2661, was introduced earlier in March.

The identical bills seek to authorize the State Board of Investment to allocate public funds into Bitcoin, marking a direct acknowledgment of the digital asset’s long-term financial potential.

Meanwhile in Alabama, Senate Bill 283, filed this week by Sen. April Weaver (R-AL)is a companion to House Bill 482, introduced earlier in March.

Though neither bill explicitly names Bitcoin, the legislation limits eligibility to digital assets with a market capitalization of at least $750 billion.

Currently, only Bitcoin meets that threshold, effectively making it the sole qualifying asset under the proposed framework.

If the proposals pass, they would take effect on October 1, 2025 in Alabama and January 1, 2026 in Minnesota.

Both states are embracing a legislative tactic commonly used to fast-track approval: introducing identical bills in both chambers.

HF 2946/SF 2661 would allow the state to not only invest in Bitcoin but also accept it for tax payments and government transactions.

The bill amends more than a dozen statutes to incorporate crypto, including tax codes, pension plans, and investment rules.

The Alabama legislation also outlines digital assets must be held directly by the treasurer, by a qualified custodian, or via exchange-traded products, and cannot exceed 10% of any state fund.

U.S. state Bitcoin reserve proposals

The proposals follow a wider trend of state-level efforts across the U.S. to explore the world’s largest crypto as a strategic reserve asset.

While some states, including Wyoming, Montana, and Pennsylvania, have recently paused or withdrawn their Bitcoin reserve plans, the momentum remains strong elsewhere.

South Carolina recently introduced a bill to allow its treasurer to allocate up to 10% of certain state funds into digital assets—starting with Bitcoin.

Oklahoma’s House Bill 1203, which allows for crypto asset reserves, passed overwhelmingly and is pending Senate review. Texas passed Senate Bill 21 to establish a Bitcoin strategic reserve and is awaiting gubernatorial approval.

Arizona and Utah have introduced their own frameworks, although Utah’s reserve language was dropped during revisions.

Bitcoin reserve tracker Bitcoin Law’s data shows that 47 state-level Bitcoin reserve bills have been introduced in 26 states, 41 of which are currently live.

Sentiment around the passing of a state Bitcoin reserve proposal appears to have turned negative, however. Users of MYRIAD, the decentralized prediction market launched by Decrypt’s parent company DASTAN, overwhelmingly predicted that no state would implement such a reserve, in a market that closed at the end of March.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.



Source link

Continue Reading

Coins

There’s More to North Korea’s Hacking Ops Than Just Lazarus Group: Paradigm

Published

on



In February, North Korean hackers broke headlines with what is now regarded as the largest single hack in crypto history.

The Lazarus Group stole at least $1.4 billion from Bybit and later funneled those funds to crypto mixers.

“Someone had pulled off the biggest hack in [crypto] history, and we had a front-row seat,” Samczsun, Research Partner at Paradigm, recalled in a blog post.

The researcher said they witnessed the theft in real-time and collaborated with Bybit to confirm the unauthorized access.

Samczsun was working with SEAL 911, an emergency response unit affiliated with the Security Alliance, a nonprofit organization dedicated to securing decentralized systems.

But these attacks aren’t all just about the Lazarus Group. There’s more to North Korea’s cyber offensives than previously thought.

There’s a misconception about how to “classify and name” the group’s operations.

While the term “Lazarus Group” is “colloquially acceptable,” discussing how the DPRK (Democratic People’s Republic of Korea) runs its cyber operations on the offensive needs more rigor, Samczsun claimed.

Lazarus Group has become the preferred term by the media when describing DPRK cyberactivity. Cybersecurity researchers “created more precise designations” to show which ones are working on specific activities, they added.

A hacking bureau

The DPRK’s hacking ecosystem operates under the Reconnaissance General Bureau (RGB), which houses several distinct groups: AppleJeus, APT38, DangerousPassword, and TraderTraito

These groups operate with specific targeting methodologies and technical capabilities.

TraderTraitor, identified as the most sophisticated DPRK actor targeting the crypto industry, focuses on exchanges with large reserves and employs advanced techniques, successfully compromising Axie Infinity through fake job offers and manipulating WazirX.

AppleJeus specializes in complex supply chain attacks, including the 2023 3CX hack that potentially affected 12 million users.

Dangerous Password, meanwhile, conducts lower-end social engineering through phishing emails and malicious messaging on platforms like Telegram.

Another subgroup, APT38, spun out of Lazarus in 2016 and focused on financial crimes. It first targeted traditional banks before shifting attention to crypto platforms.

In 2018, the OFAC first mentioned “North Korean IT workers,” which in 2023 were identified by researchers as “Contagious Interview” and “Wagemole,” operating through schemes where the threat actors either pose as recruiters or attempt to get hired by target companies.

There’s still hope

While the DPRK has shown its ability to deploy zero-day attacks, there have been “no recorded or known incidents” of it deploying directly against the crypto industry, Samczsun said.

The researcher urged crypto companies to implement basic security practices such as least privilege access, two-factor authentication, and device segregation. If preventive measures fail, connecting with security groups like SEAL 911 and the FBI’s DPRK unit would also be helpful.

“DPRK hackers are an ever-growing threat against our industry, and we can’t defeat an enemy that we don’t know or understand,” Samczsun wrote.

Edited by Sebastian Sinclair

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.



Source link

Continue Reading

Coins

Why ‘Tiger King’ Joe Exotic Launched a Solana Meme Coin From Behind Bars

Published

on



Why did Joseph Maldonado-Passage, better known as Joe Exotic from the viral Netflix docuseries “Tiger King,” debut a meme coin on Solana from prison earlier this week?

“I’m knee-deep in lawyer bills,” he told Decrypt in an interview, claiming the endeavor will also benefit children through donations to a nonprofit called Operation Smile.

The 62-year-old, who has lived behind bars for seven years, didn’t launch the meme coin himself. Instead, he said his lawyers helped him get “Official Tiger King” off the ground, which began trading under the ticker name EXOTIC on Monday.

Most celebrity meme coins end up as flash in the pan. Their value often hinges on people’s attention, which can fade quickly. Others end up marred by allegations of insider trading. Exotic said he’s hopeful that his token doesn’t end up becoming yet another example.

“I pray to god that they don’t rug it and ruin my reputation,” the former wildlife park owner said. “I’m hoping that people will see this is legit and it has a purpose.”

Celebrity meme coins, while nothing new, reached a boiling point last year, with names like Caitlyn Jenner, Jason Derulo, and Cardi B stepping into the space. Hailey Welch, also known as “Hawk Tuah girl,” was among those that got caught flat-footed. Her coin, dubbed HAWK, became a fiasco after it imploded. A spokesperson told Decrypt she “had zero control over it.”

EXOTIC debuted on a little-known launchpad called pumpkin.fun. The meme coin’s market cap initially surged to $900,000 but has since fallen to just over $100,000, according to the crypto data provider GeckoTerminal. It has less than 900 holders in total, per blockchain data.

The website for Exotic’s meme coin does not reference the project’s goal of contributing funds to Operation Smile. However, it does say tokens will be donated to a “foundation supporting tigers or animal health” upon his release from prison. On Friday, Exotic’s account on X, formerly known as Twitter, said it had already donated $1,000 to the nonprofit.

Exotic says his lawyers got behind the idea of launching a meme coin as a way to showcase his commitment to charitable work. That’s a reason for him to be free, he said, as opposed to “sitting in here, watching people do drugs all day.”

Project Smiles and Exotic’s lawyers did not respond to requests for comment from Decrypt.

Exotic is currently being held at FMC Fort Worth, an administrative security center, according to the U.S. Federal Bureau of Prisons He routinely uses the telephone to connect with the outside world, keeping fans up-to-date via podcasts and X Spaces.

When it comes to crypto, Exotic has been able to absorb a lot, even learning from other inmates. While familiar with key terms, his real-word experience is admittedly limited.

“There’s not a lot to do all day besides sit and talk to people who know shit,” he said. “I do a lot from here, but I don’t even know how to set up a wallet.”

In 2021, Joe Exotic was resentenced to 21 years in federal prison, per the Associated Press. He was convicted of a murder-for-hire scheme against animal welfare activist Carole Baskin, killing five tigers, selling tiger cubs, and falsifying wildlife records.

Exotic maintains his innocence, while also pressing U.S. President Donald Trump for a pardon on social media.

In 2021, an unofficial meme coin called “Tiger King Coin” was launched as well. Exotic said he was entitled to receive 1% of its supply, but never found out who was behind the project. He fears that coin may influence people’s perceptions of the one that just launched. 

Operation Smile, founded in 1982, provides cleft lip and palate repair surgeries for children across the world. Exotic hopes his meme coin can ultimately help that initiative moving forward.

“People really need to invest in it,” he said. “I would like to be able to get it up there to where I can fix 500 kids’ [faces] and pay my lawyer bills.”

Edited by Andrew Hayward

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.



Source link

Continue Reading
Advertisement [ethereumads]

Trending

    wpChatIcon