Elliptic Investigations

The latest news and analysis from the Investigations Team at Elliptic, the leading blockchain analytics provider.
Contact us:

[Tom Robinson @tomrobin]

Following the release of our research linking Huione Guarantee and Huione Pay to the laundering of proceeds of online scams, Tether has blacklisted a TRON address belonging to Huione Pay, freezing $29.6 million.
TNVaKWQzau7xL9bcnvLmF9KSEQkWEs4Ug8

[Elliptic Investigations @Elliptic_Inv]

Based on the $PLA market price at the time of the thefts, the total value of stolen tokens is $290 million. However, prior to the breaches the circulating supply was only ~577 million, and it's unlikely the hacker could realise anything close to this amount.

[Elliptic Investigations @Elliptic_Inv]

A further 1.59 billion $PLA tokens have been stolen from @playdapp_io - by the same exploiter who minted 200 million on Friday:
https://t.co/L35uB2znEF

[Elliptic Investigations @Elliptic_Inv]

@CarlaRamre83350 Yes absolutely! The above tactics are totally useless against clients who make use of our holistic screening capability for their transaction monitoring.

https://t.co/fEdN0pLiE3

[Elliptic Investigations @Elliptic_Inv]

1/7 The deployment of these contracts is interesting. Not only does it point to further confluence between the laundering of this hack and the Harmony hack (they did the same back in February) - it shows the importance of taking a holistic approach to transaction monitoring...

[Tay 💖 @tayvano_]

After that aforementioned Railgun run, I guess they didn't want to risk using a thing thats maybe decentralized or maybe decentralization-theatre? Esp. if it wasnt making them anon?

So, naturally, they just wrote their own contracts.

e.g. on Jan28...

https://t.co/3rkpG5xJ7P

[Elliptic Investigations @Elliptic_Inv]

7/7 These two tactics, swapping assets and layering complex transactions, are just two examples of typologies we have observed recently associated with Lazarus. To find more about other typologies read our newly-released Typologies Report here.

https://t.co/rna25tPwNh

[Elliptic Investigations @Elliptic_Inv]

6/7 After the swapping assets, Lazarus have moved through a large number of complex hops (splitting and reconsolidating), again a deliberate attempt to obfuscate their source of funds, before bridging their assets to Avalanche through the Avalanche Bridge.

[Elliptic Investigations @Elliptic_Inv]

@BradyDale @tayvano_ @zachxbt @elliptic We're aware of reported losses that total more than $100 million
https://t.co/eyUz3zisFh

[Elliptic Investigations @Elliptic_Inv]

Reported losses from the @AtomicWallet hack are now over $100 million
https://t.co/pPYSfoAU6r

[Elliptic Investigations @Elliptic_Inv]

This includes 10 addresses that have lost more than $1M, and 164 that have lost more than $100k. The median loss is $2.8k

[Elliptic Investigations @Elliptic_Inv]

Reported losses from the @AtomicWallet hack are now over $100 million
https://t.co/pPYSfoAU6r

[Elliptic Investigations @Elliptic_Inv]

@elliptic @AtomicWallet Funds withdrawn as BTC continue to be laundered through Sinbad(Blender?).io.

[Elliptic Investigations @Elliptic_Inv]

After a significant and successful cross-community effort between @elliptic, many of our exchange partners and friends to freeze stolen @AtomicWallet funds, Lazarus have now turned to OFAC-sanctioned Exchange, Garantex, to trade their assets for BTC...

[Elliptic Investigations @Elliptic_Inv]

..and another TRON account https://t.co/LJzQWgklke

[Elliptic Investigations @Elliptic_Inv]

Atomic Wallet hack funds have just been swapped for USDT and bridged to TRON https://t.co/LU63FROG6X

[Elliptic Investigations @Elliptic_Inv]

@CoinDesk @baydakova Affected users can reach out to @AtomicWallet at [email protected] - information will then be passed to the relevant parties for further investigation.

[Elliptic Investigations @Elliptic_Inv]

@Thomas_Hunter11 @AtomicWallet Please reach out to @AtomicWallet at [email protected] and they will pass the details to the relevant parties for investigation.

[Elliptic Investigations @Elliptic_Inv]

The $35 million stolen from @AtomicWallet users is being laundered through Sinbad - the mixer fka(?) Blender and used heavily by NK's Lazarus Group
https://t.co/UHCwfZiw8e