North Korean Hackers Move $11 Million from WazirX Attack to Tornado Cash

North Korean Hackers Move Stolen Funds from WazirX Attack

The North Korean group responsible for one of India’s largest cryptocurrency hacks has transferred approximately $11 million in stolen ether (ETH) as of early Monday. This transaction is part of a series of movements to the mixing service, Tornado Cash, aimed at obscuring the origin of the funds.

According to wallet data tracked by Arkham, over 5,000 ETH—valued at just over $11 million based on current market prices—was relocated from the July attack on the crypto exchange WazirX to a new wallet address at 07:19 UTC. Subsequently, approximately $1.2 million in various tokens was further transferred from this new address to Tornado Cash through five separate transactions.

Tornado Cash is a service that allows cryptocurrency users to exchange tokens while concealing wallet addresses across different blockchains. Although the service itself is legitimate, it is frequently exploited by cybercriminals to obscure their online activities and eliminate traces that could lead back to them.

This latest series of transactions follows a previous transfer of $4 million that occurred last week, which was first reported by CoinDesk. The hacker’s main wallet currently holds an astonishing value of over $107 million in various cryptocurrencies, with a significant portion—approximately $100 million—in ether.

In July, WazirX experienced a major security breach involving one of its multisignature wallets, leading to the theft of over $100 million in shiba inu (SHIB) tokens and an additional $52 million in ether, among other digital assets. The stolen funds represented over 45% of the total reserves reported by the exchange in a report from June 2024. Following the breach, WazirX has initiated a restructuring process to address its liabilities.