North Korean Cybercrime: Lazarus Group Launders Millions Through Cambodian Firm

• North Korean hackers laundered $150,000 in stolen crypto through Cambodian firm Huione Pay.
• Lazarus’ group used phishing attacks to steal from Atomic Wallet, CoinsPaid, and Alphapo.
• Huione Pay unknowingly received stolen funds, highlighting regulatory and compliance gaps.

New evidence suggests North Korea’s Lazarus Group laundered over $150,000 in stolen cryptocurrency through Huione Pay, a Cambodian payments firm, highlighting the group’s sophisticated tactics and the challenges of combating crypto-related crime in Southeast Asia.

This revelation offers a glimpse into the sophisticated methods the Lazarus group employs to launder funds in Southeast Asia. Despite Huione Pay’s claims of ignorance, blockchain analysis shows that the company received the illicit funds between June 2023 and February 2024.

Huione Pay, the Cambodian firm implicated, offers currency exchange, payments, and remittance services. The company received the stolen crypto but claimed it was unaware of their origins. The company’s board, which includes Hun To, a cousin of Cambodia’s Prime Minister, stated that multiple transactions between the hacker’s wallet and their own made it difficult to detect the source.

The FBI identified the Lazarus group as being responsible for stealing around $160 million from crypto firms. They used phishing attacks to execute these hacks. These attacks are part of a series of heists funding North Korea’s weapons programs. The United Nations has highlighted how North Korea uses cryptocurrency to bypass international sanctions, aiding in illegal transactions. The Royal United Services Institute also stated that crypto may help North Korea purchase banned goods and services.

Despite regulations, the National Bank of Cambodia (NBC) prohibits payment firms from dealing in cryptocurrencies. This ban aims to prevent investment losses and cybercrime. The NBC stated that it would impose corrective measures against Huione Pay if necessary. However, it did not specify what actions it planned to take.

TRM Labs and Merkle Science, blockchain analysis firms, traced the movement of stolen funds. They revealed that the Lazarus group used the Tron blockchain to convert the stolen crypto into tether (USDT). They then moved the funds through various exchanges and over-the-counter brokers. These brokers offer traders more privacy than regular crypto exchanges.

The Lazarus group employs sophisticated techniques to launder stolen crypto. These techniques involve multiple transfers between wallets to hide the money trail. The stolen funds were also converted into different cryptocurrencies to further obscure their origins.

Southeast Asia, with its many unregulated crypto service providers, has become a hotbed for high-tech money laundering. The United Nations has pointed out the region’s critical role in such operations. Despite being removed from the FATF’s “gray list,” Cambodia faces scrutiny for its anti-money laundering policies.