UPDATE to 6/28/2022 FLASH UPDATE: Researchers from Elliptic have discovered ties between the hack of Harmony’s cryptocurrency bridge “Horizon” and the Lazarus Group. The Lazarus Group is an infamous threat group that is associated with the North Korean government. Their attacks often target organizations that would allow the group to extract the most profit to fund North Korean government projects. The group has been known to target cryptocurrency organizations and platforms, such as the Ronin Bridge hack in March 2022. Elliptic researchers tracked the stolen cryptocurrency following the Horizon Bridge heist. They discovered that 41% of the $100 million in stolen cryptocurrency was sent to the “Tornado Cash” mixer. A mixer is a service that allows users to trade stolen or tainted cryptocurrency for legitimate assets, effectively laundering them. While it is normally extremely difficult to trace cryptocurrency after it has been mixed, Elliptic claims to have “demixing techniques” that have allowed them to trace the stolen cryptocurrency to multiple Ethereum wallets. This allows cryptocurrency organizations to use a screening service to detect if the cryptocurrency they are receiving has originated from the Horizon Bridge hack. There are multiple pieces of evidence that link the Horizon Bridge heist to the Lazarus Group. First, the multi-signature wallet keys were likely stolen through social engineering, a common technique used by the Lazarus Group. Second, the Lazarus Group focuses of the APAC region, where many of Harmony’s core team reside. Finally, the timing of the deposits into the Tornado Cash network suggest it was an “automated process.” The Lazarus Group has needed to launder many forms of cryptocurrency in the past and has created and used programs to clean their stolen cryptocurrency assets. These reasons lead Elliptic to attribute the Horizon Bridge heist to the Lazarus Group. CTIX analysts will continue to monitor the situation and will update if there is more activity with the stolen funds.