How Atomic Wallet Hackers Leveraged THORChain to Hide $35 Million Theft

In a recent heist that targeted the popular crypto wallet Atomic Wallet, hackers managed to conceal their stolen funds worth $35 million using the cross-chain liquidity protocol THORChain.

Blockchain sleuth MistTrack has shed light on the incident, revealing that approximately $870,000 worth of ether (ETH) was transferred to THORChain before being exchanged for bitcoin (BTC).

Additionally, some of the stolen ether was routed to multiple Bitcoin addresses via the Swft blockchain. Notably, the hackers also attempted to move a portion of the stolen funds to the crypto exchange Garantex, which has previously faced sanctions from the U.S. Treasury’s Office of Foreign Assets Control (OFAC).

While suspicions point to the North Korean hacking group Lazarus as the culprit, THORChain’s native token (RUNE) has remained stable, trading at 84 cents on CoinMarketCap.

According to MistTrack’s investigation, hackers successfully utilized THORChain to conceal their ill-gotten gains. Around $870,000 worth of ETH, equivalent to 503.08 ether, was transferred to THORChain in the two days prior to being converted into BTC.

This cross-chain liquidity protocol facilitated the seamless exchange of the stolen funds, allowing the hackers to cover their tracks.

Furthermore, the stolen ether was also funneled through the Swft blockchain, enabling the hackers to bridge the funds to multiple Bitcoin addresses.

The hackers attempted to move a portion of their stolen funds to the crypto exchange Garantex. Notably, Garantex has previously faced sanctions from the OFAC, which oversees compliance with U.S. economic and trade sanctions.

It remains to be seen how this development will impact the ongoing investigation and recovery of the stolen funds.

Blockchain security firm Elliptic has indicated that the Lazarus hacking group, associated with North Korea, is likely behind the Atomic Wallet hack. Lazarus has gained notoriety for its involvement in various high-profile cyberattacks and cryptocurrency-related incidents.

Despite the hack-related transactions, THORChain’s native token (RUNE) has remained stable in the market.

According to CoinMarketCap, it is currently trading at 84 cents, with a slight increase over the past 24 hours. This stability suggests that investors and traders have not been significantly deterred by the recent incident.